Switch to “Native Windows Secure Channel library”

问题:

During the installation of Git on my Windows machine, I selected "Use the OpenSSL library" for HTTPS Transport backend.

I would like to switch to "Native Windows Secure Channel library" for HTTPS Transport.

Is this possible without re-installing git on Windows?

回答1:

I found the setting for "schannel" or "openssl" with Git for Windows 2.14.2, 64 bit in file:

C:\Program Files\Git\mingw64\etc\gitconfig

Example config for OpenSSL:

[http]
sslCAInfo = C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt
sslBackend = openssl

Example config for Windows native:

[http]
sslCAInfo = C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt
sslBackend = schannel

回答2:

This is now offically supported with Git 2.20 (Q4 2018): On platforms with recent cURL library, http.sslBackend configuration variable can be used to choose a different SSL backend at runtime.
The Windows port uses this mechanism to switch between OpenSSL and Secure Channel while talking over the HTTPS protocol.

See commit b67d40a (25 Oct 2018), and commit 21084e8 (15 Oct 2018) by Johannes Schindelin (dscho).
See commit 93aef7c (25 Oct 2018) by Brendan Forster (shiftkey).
^{(Merged by Junio C Hamano -- gitster -- in commit d7b1859, 02 Nov 2018)}

http: add support for selecting SSL backends at runtime

As of version 7.56.0, curl supports being compiled with multiple SSL backends.

This patch adds the Git side of that feature: by setting http.sslBackend to "openssl" or "schannel", Git for Windows can now choose the SSL backend at runtime.

This comes in handy on Windows because Secure Channel ("schannel") is the native solution, accessing the Windows Credential Store, thereby allowing for enterprise-wide management of certificates.
For historical reasons, Git for Windows needs to support OpenSSL still, as it has previously been the only supported SSL backend in Git for Windows for almost a decade.

The patch has been carried in Git for Windows for over a year, and is considered mature.

回答3:

You can check out this thread from the Git for Windows maintainer:

Yes, it is possible, and you can find out how exactly it is done by inspecting the source code for the installer, which is at https://github.com/git-for-windows/build-extra in the installer/install.iss file (this file is also easily found by a git grep "Secure Channel").

The relevant part is when the installer tests for the GC_WinSSL option to do more interesting stuff than recording the user's choice:

if RdbCurlVariant[GC_WinSSL].Checked and (not
    ReplaceFile(BinDir+'curl-winssl\curl.exe',BinDir+'curl.exe') or not
    ReplaceFile(BinDir+'curl-winssl\libcurl-4.dll',BinDir+'libcurl-4.dll'))
then begin
            Log('Line {#__LINE__}: Replacing curl-openssl with curl-winssl failed.');
end;

(See https://github.com/git-for-windows/build-extra/blob/97c8294b584ae4b99059a1194a5eba24ee2ff1ab/installer/install.iss#L1774)

In other words, the installer will simply try to replace the curl.exe and libcurl-4.dll files in \mingw64\bin (or the 32-bit equivalent) by the files in \mingw64\curl-winssl.

回答4:

The issue has been resolved by the Git for Windows developer: https://github.com/git-for-windows/git/issues/1274