Handshake Failure when cloning a git repository which requires a certificate

# The Problem I have been having issues connecting to a Atlassian Stash which requires a certificate issued by my company. When I connect using Firefox (which has the certificate) it will allow me to go onto the website, but when I try to clone the git repository using bash (on Pop_OS! 20.04, which is based upon the same Ubuntu version) then I get the following error:

> git clone https://cmstash.cm.website.com/scm/cded/prototyping.git 
    Cloning into 'prototyping'...
    fatal: unable to access 'https://cmstash.cm.website.com/scm/cded/prototyping.git/ ': gnutls_handshake() failed: Handshake failed

# How I setup the certificates I have 3 files, 4125B9-ca.crt, 4125B9.crt and 4125B9.key. These are placed in /usr/share/ca-certificates/work/. I then ran sudo update-ca-certificates --fresh and selected the .crt files when running sudo dpkg-reconfigure ca-certificates. This gave the warning:

warning: skipping 4125B9-ca.pem,it does not contain exactly one certificate or CRL

# How I debugged the problem I've tried different commands to test the connection, some information has been removed for security reasons. I started with openssl's s_client:

> sudo openssl s_client -connect cmstash.cm.website.com:443 -CAfile /etc/ssl/certs/ca-certificates.crt -tls1_2

    CONNECTED(00000003)
    [depth 1 & 2 removed]
    depth=0 CN = *.website.com, O = [O removed], OU = IT-Department, OU = CM, [C & L removed]
    verify return:1
    140405633332544:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/recor /rec_layer_s3.c:1543:SSL alert number 40
    ---
    Certificate chain
    [Certificate chain removed]
    ---
    Server certificate
    -----BEGIN CERTIFICATE-----
    [Certificate removed]
    -----END CERTIFICATE-----
    [Subject and Issuer removed]
    ---
    Acceptable client certificate CA names
    [acceptable client certificate names removed]

    Client Certificate Types: RSA sign, DSA sign, ECDSA sign
    Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
    Shared Requested Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224
    Peer signing digest: SHA512
    Peer signature type: RSA
    Server Temp Key: ECDH, P-256, 256 bits
    ---
    SSL handshake has read 4110 bytes and written 447 bytes
    Verification: OK
    ---
    New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
    Server public key is 4096 bit
    Secure Renegotiation IS supported
    Compression: NONE
    Expansion: NONE
    No ALPN negotiated
    SSL-Session:
        Protocol  : TLSv1.2
        Cipher    : ECDHE-RSA-AES128-GCM-SHA256
        Session-ID:
        Session-ID-ctx:
        Master-Key: [Master Key removed]
        PSK identity: None
        PSK identity hint: None
        SRP username: None
        Start Time: 1600242853
        Timeout   : 7200 (sec)
        Verify return code: 0 (ok)
        Extended master secret: no
   ---

After seeing the Acceptable client certificate CA names, I checked it against my certificate but the CA name was the same. I then tried to use curl:

curl -iv --ciphers DEFAULT@SECLEVEL=1 https://cmstash.website.com 
    *   Trying 212.203.27.120:443...
    * TCP_NODELAY set
    * Connected to cmstash.cm.website.com ([IP removed]) port 443 (#0)
    * ALPN, offering h2
    * ALPN, offering http/1.1
    * Cipher selection: DEFAULT@SECLEVEL=1
    * successfully set certificate verify locations:
    *   CAfile: /etc/ssl/certs/ca-certificates.crt
      CApath: /etc/ssl/certs
    * TLSv1.3 (OUT), TLS handshake, Client hello (1):
    * TLSv1.3 (IN), TLS handshake, Server hello (2):
    * TLSv1.2 (IN), TLS handshake, Certificate (11):
    * TLSv1.2 (IN), TLS handshake, Server key exchange (12):
    * TLSv1.2 (IN), TLS handshake, Request CERT (13):
    * TLSv1.2 (IN), TLS handshake, Server finished (14):
    * TLSv1.2 (OUT), TLS handshake, Certificate (11):
    * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
    * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
    * TLSv1.2 (OUT), TLS handshake, Finished (20):
    * TLSv1.2 (IN), TLS alert, handshake failure (552):
    * error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
    * Closing connection 0
    curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure

After this did not give me more information I tried gnutls:

gnutls-cli -d 0 -V cmstash.cm.website.com:443

    - Status: The certificate is trusted.
    - Server's trusted authorities:
       [Authorities removed]
    - Successfully sent 0 certificate(s) to server.
    *** Fatal error: A TLS fatal alert has been received.
    *** Received alert : Handshake failed

It seems to be a TLS issue and not directly related to git. Sadly the error messages only say that the handshake failed, but not why or how. # Other information * The website does not support SSLv3 or TLS1.3, so I used TLS1.2 * The certificate is valid, as it does work when used in Firefox