The push failed. The error read: gnutls_handshake() failed: Error in the pull function. Your deploy was dead in the water, and the culprit was clear—Git checkout TLS configuration.
When Git communicates over HTTPS, it depends on Transport Layer Security (TLS) for encryption and integrity. A broken TLS setup means your code never even reaches the remote. This issue often appears when working with self‑signed certificates, outdated libraries, or mismatched TLS versions between client and server.
Check your Git TLS settings
Run:
git config --list --show-origin | grep http
Look for http.sslVerify, http.sslBackend, and any custom CA paths. If sslVerify is set to false, Git skips TLS checks, which is insecure. Use it only for rapid debugging, then restore strict checks.
Set custom certificate authorities
If your server uses a private certificate chain:
git config --global http.sslCAInfo /path/to/ca.crt
Ensure the CA file is readable by the environment where Git runs.
Force a specific TLS backend
Some builds of Git support http.sslBackend=schannel (Windows) or openssl (Linux) instead of GNUTLS. Switching can bypass handshake bugs in specific libraries:
git config --global http.sslBackend openssl
Verify protocol compatibility
TLS handshake failures can come from protocol mismatches. Use openssl s_client -connect yourdomain.com:443 -tls1_2 to confirm which versions your server accepts. Then update Git or your system libraries to match.
Update dependencies
Old versions of Git may link to outdated TLS libraries. Upgrading Git, curl, and your SSL backend often resolves persistent errors. On Linux, this may require updating libgnutls or OpenSSL packages.
Test with shallow clones
If the handshake works for small fetches but fails on large ones, the problem may be network-level TLS timeouts. Adjust server settings or clone with smaller depth before expanding.
Reliable TLS configuration in Git checkout flows keeps deployments secure and predictable. Skip it, and you risk builds failing at the worst possible moment.
See secure Git checkout with correct TLS configuration running in minutes—try it now at hoop.dev.