How to resolve the fatal error of git pull command?

[Mahesh Kumar]

Hello,

Can anyone please help resolve this issue.

I am trying to run git pull command to pull the files to the local directory.

I issued the following commands on the Linux terminal and ended up in getting the error message. All these days these commands worked without any issues but suddenly from yesterday i am getting the error.

$git pull

$unset SSH_ASKPASS

$git pull origin _BRANCH_NAME_

error: while accessing https://ITCBitbucket_uei@bitbucket.org/universal-ondemand/oracler12.git/info/refs

fatal: HTTP request failed

Thank you.

[jredmond · Accepted solution]

You can get diagnostic information on HTTPS-based Git operations with GIT_CURL_VERBOSE=1:

GIT_CURL_VERBOSE=1 git pull origin UEI-IT-Development

The error message you've listed, though, suggests that you might be running into a TLS protocol version mismatch caused by https://bitbucket.org/blog/deprecating-tlsv1-tlsv1-1-2018-12-01 - does the pull command with GIT_CURL_VERBOSE mention anything about the server certificate?

[Mahesh Kumar]

Hi Jim,

Thank you for helping me on this issue.

I did run the git pull in verbose mode and received following logs. Can you suggest what could be the issue?

The error message talks about netrc file and TLS handshake error.

GIT_CURL_VERBOSE=1 git pull origin UEI-IT-Development
Password:
* Couldn't find host bitbucket.org in the .netrc file; using defaults
* About to connect() to bitbucket.org port 443 (#0)
* Trying 18.205.93.2... * Connected to bitbucket.org (18.205.93.2) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* NSS error -12286
* Error in TLS handshake, trying SSLv3...
> GET /universal-ondemand/oracler12.git/info/refs?service=git-upload-pack HTTP/1.1
User-Agent: git/1.7.1
Host: bitbucket.org
Accept: */*
Pragma: no-cache

* Connection died, retrying a fresh connect
* Expire cleared
* Closing connection #0
* Issue another request to this URL: 'https://ITCBitbucket_uei@bitbucket.org/universal-ondemand/oracler12.git/info/refs?service=git-upload-pack'
* Couldn't find host bitbucket.org in the .netrc file; using defaults
* About to connect() to bitbucket.org port 443 (#0)
* Trying 18.205.93.2... * Connected to bitbucket.org (18.205.93.2) port 443 (#0)
* TLS disabled due to previous handshake failure
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* NSS error -12286
* Expire cleared
* Closing connection #0
* Couldn't find host bitbucket.org in the .netrc file; using defaults
* About to connect() to bitbucket.org port 443 (#0)
* Trying 18.205.93.2... * Connected to bitbucket.org (18.205.93.2) port 443 (#0)
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* NSS error -12286
* Error in TLS handshake, trying SSLv3...
> GET /universal-ondemand/oracler12.git/info/refs HTTP/1.1
User-Agent: git/1.7.1
Host: bitbucket.org
Accept: */*
Pragma: no-cache

* Connection died, retrying a fresh connect
* Expire cleared
* Closing connection #0
* Issue another request to this URL: 'https://ITCBitbucket_uei@bitbucket.org/universal-ondemand/oracler12.git/info/refs'
* Couldn't find host bitbucket.org in the .netrc file; using defaults
* About to connect() to bitbucket.org port 443 (#0)
* Trying 18.205.93.2... * Connected to bitbucket.org (18.205.93.2) port 443 (#0)
* TLS disabled due to previous handshake failure
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* NSS error -12286
* Expire cleared
* Closing connection #0
error: while accessing https://ITCBitbucket_uei@bitbucket.org/universal-ondemand/oracler12.git/info/refs

[Mahesh Kumar]

This is resolved.

This got resolved after updating TLS version.

https://bitbucket.org/blog/deprecating-tlsv1-tlsv1-1-2018-12-01

• The Git command line on UNIX-based systems (including macOS, Linux, and all BSDs) may be affected. You should be able to test your connection from the command line: GIT_CURL_VERBOSE=1 git ls-remote https://bitbucket.org/ This will connect to Bitbucket using the Git client and list the connection parameters. If you see a line like “SSL connection using TLSv1.2” in the output, then you are unaffected; if that line mentions a different version of TLS, then you are affected. UPDATE 2018-11-28: If you don’t see a line like that, then your client uses an older version of curl (prior to v7.40.0); however, if the cipher suite itself mentions “GCM”, “SHA256”, or “SHA384”, then you should be unaffected.