68

When I try to connect to any HTTPS server with git, it gives the following error:

error: gnutls_handshake() failed: A TLS packet with unexpected length was received. while accessing ...
fatal: HTTP request failed

I think that maybe some packages that are related to gnutls_handshake have been broken. So, I want to reinstall those.

Which packages can be related to these errors? Or how do I fix this kind of error?

2
  • 2
    This other question might help. Sep 12 '12 at 12:53
  • 1
    In my case it was a simple authentication server, to which we have to login before using the internet, which was coming in the way. I had to login there first, and then the error vanished. Jul 24 '16 at 15:00
98

Got reason of the problem, it was gnutls package. It's working weird behind a proxy. But openssl is working fine even in weak network. So workaround is that we should compile git with openssl. To do this, run the following commands:

sudo apt-get update
sudo apt-get install build-essential fakeroot dpkg-dev
sudo apt-get build-dep git
mkdir ~/git-openssl
cd ~/git-openssl
apt-get source git
dpkg-source -x git_1.7.9.5-1.dsc
cd git-1.7.9.5

(Remember to replace 1.7.9.5 with the actual version of git in your system.)

Then, edit debian/control file (run the command: gksu gedit debian/control) and replace all instances of libcurl4-gnutls-dev with libcurl4-openssl-dev.

Then build the package (if it's failing on test, you can remove the line TEST=test from the file debian/rules):

sudo apt-get install libcurl4-openssl-dev
sudo dpkg-buildpackage -rfakeroot -b

Install new package:

i386: sudo dpkg -i ../git_1.7.9.5-1_i386.deb

x86_64: sudo dpkg -i ../git_1.7.9.5-1_amd64.deb


Inspired from here: https://github.com/xmendez/wfuzz/wiki/PyCurlSSLBug

20
  • 2
    Had this same issue after upgrading to Ubuntu 14.04. This solution worked great!
    – vertti
    Apr 23 '14 at 10:34
  • 1
    Worked with Linux Mint 16, you have to go to "Software Sources" and enable sources on official repositories. You must also uninstall libcurl4-gnutls-dev and replace by libcurl4-openssl-dev prior to compiling. Jun 12 '14 at 9:05
  • 1
    Might help the wondering minds. If you're using 'repo' to download a repository (say android source code) and come across the gnutls-handshake problem, @Nyambaa's answer works. Repo is a script which depends on Git, so you should be good. Worked like magic on my Ubuntu 14.04 lts
    – KhoPhi
    Nov 16 '14 at 3:11
  • 3
    Shellscript for people's (mainly my own) sanity. github.com/SonOfLysander/git-openssl-shellscript/blob/master/… Aug 10 '15 at 23:38
  • 4
    the tests in the build step take a really long time. if you trust the git maintainers, I highly suggest following the instructions above to skip them by removing the TEST=test line from debian/rules. Sep 30 '15 at 16:01
9

For me, it ended up being that SSL certificate was self-signed. Give this a try

git config --global http.sslVerify false

1
  • 17
    That's a terrible idea; it disables all authentication for every TLS (SSL) connection made by git, removing your protection from man-in-the-middle attacks.
    – cjs
    Aug 7 '18 at 9:36
2

This is mentioned in one of the comments to another answer but I feel it needs to be more visible https://askubuntu.com/users/177551/paul-nelson-baker has written a shell script which, for me, resolved this issue.

The script is available in his repository https://github.com/paul-nelson-baker/git-openssl-shellscript and re-compiles git with openssl instead of gnutls. Read the README for the whole story but it worked for me so thank you Paul.

Not the answer you're looking for? Browse other questions tagged or ask your own question.