Switch to "Native Windows Secure Channel library" from "OpenSSL library" on Windows Git, without reinstalling?
I found the setting for "schannel" or "openssl" with Git for Windows 2.14.2, 64 bit in file:
C:\Program Files\Git\mingw64\etc\gitconfig
Example config for OpenSSL:
[http]
sslCAInfo = C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt
sslBackend = openssl
Example config for Windows native:
[http]
sslCAInfo = C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt
sslBackend = schannel
You can check out this thread from the Git for Windows maintainer:
Yes, it is possible, and you can find out how exactly it is done by inspecting the source code for the installer, which is at https://github.com/git-for-windows/build-extra in the installer/install.iss file (this file is also easily found by a
git grep "Secure Channel"
).The relevant part is when the installer tests for the GC_WinSSL option to do more interesting stuff than recording the user's choice:
if RdbCurlVariant[GC_WinSSL].Checked and (not
ReplaceFile(BinDir+'curl-winssl\curl.exe',BinDir+'curl.exe') or not
ReplaceFile(BinDir+'curl-winssl\libcurl-4.dll',BinDir+'libcurl-4.dll'))
then begin
Log('Line {#__LINE__}: Replacing curl-openssl with curl-winssl failed.');
end;
(See https://github.com/git-for-windows/build-extra/blob/97c8294b584ae4b99059a1194a5eba24ee2ff1ab/installer/install.iss#L1774)
In other words, the installer will simply try to replace the curl.exe and libcurl-4.dll files in \mingw64\bin (or the 32-bit equivalent) by the files in \mingw64\curl-winssl.
This is now offically supported with Git 2.20 (Q4 2018): On platforms with recent cURL library, http.sslBackend
configuration variable can be used to choose a different SSL backend at runtime.
The Windows port uses this mechanism to switch between OpenSSL and
Secure Channel while talking over the HTTPS protocol.
See commit b67d40a (25 Oct 2018), and commit 21084e8 (15 Oct 2018) by Johannes Schindelin (dscho
).
See commit 93aef7c (25 Oct 2018) by Brendan Forster (shiftkey
).
(Merged by Junio C Hamano -- gitster
-- in commit d7b1859, 02 Nov 2018)
http
: add support for selecting SSL backends at runtimeAs of version 7.56.0, curl supports being compiled with multiple SSL backends.
This patch adds the Git side of that feature: by setting
http.sslBackend
to "openssl
" or "schannel
", Git for Windows can now choose the SSL backend at runtime.This comes in handy on Windows because Secure Channel ("schannel") is the native solution, accessing the Windows Credential Store, thereby allowing for enterprise-wide management of certificates.
For historical reasons, Git for Windows needs to support OpenSSL still, as it has previously been the only supported SSL backend in Git for Windows for almost a decade.The patch has been carried in Git for Windows for over a year, and is considered mature.