How to fix a problem with connecting to Bitbucket?

Question

linux

Bitbucket news released: Deprecating TLSv1 and TLSv1.1 .
After that, the server on CentOS 6 stopped updating packages from the repository on Bitbucket.
To check the connection, I run the command:

GIT_CURL_VERBOSE=1 git ls-remote https://bitbucket.org/

As a result, I get an error:

# GIT_CURL_VERBOSE=1 git ls-remote https://bitbucket.org/
* Couldn't find host bitbucket.org in the .netrc file; using defaults
* Hostname was NOT found in DNS cache
* Trying 18.205.93.1...
* Connected to bitbucket.org (18.205.93.1) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
* Cannot communicate securely with peer: no common encryption algorithm(s).
* Closing connection 0
* Couldn't find host bitbucket.org in the .netrc file; using defaults
* Hostname was found in DNS cache
* Trying 18.205.93.1...
* Connected to bitbucket.org (18.205.93.1) port 443 (#1)
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
* Cannot communicate securely with peer: no common encryption algorithm(s).
* Closing connection 1
error: Cannot communicate securely with peer: no common encryption algorithm(s). while accessing https://bitbucket.org//info/refs
fatal: HTTP request failed

OpenSSL version:

# openssl version
OpenSSL 1.1.1a 20 Nov 2018

Help solve the problem, what should I do?
--------------------------------------
The problem was solved by upgrading cURL - How to upgrade cURL in Centos6?

Answer 1

You need to look with which openssl is built by git and curl.

Answer 2

In general, it is strange to still sit on centos6, when even with 7 it is problematic already without external repositories.
The problem is most likely in nss, and that the necessary ciphers are disabled by default, and not that they are not supported in openssl.
You need:

• Somehow update nss
  
• Find git built without curl support (wget should work for you), or curl without nss support
  
• Find how to pass curl when running git option --ciphers ecdhe_rsa_aes_128_gcm_sha_256.