我知道Let's Encrypt做了一些更改，可能会影响旧的客户端，因为根证书即将到期。请参见DST Root CA X3 Expiration (September 2021)。
然而，我认为这不会影响我，因为我的开发机器是最新的。
但今天我在进行git pull时收到了此消息：
fatal: unable to access 'https://git.company.tld/project.git/': SSL certificate problem: certificate has expired
我刚刚下载了最新的Windows版Git（2.33.0），并确认内置的OpenSSL已经更新到最新版本(OpenSSL 1.1.1k 25 Mar 2021)，应该是没有问题的。
适用于Let's Encrypt证书的OpenSSL客户端兼容性更改}
但错误似乎仍然存在。
openssl s_client -showcerts -connect git.company.tld:443
展示
CONNECTED(000001A0)
---
Certificate chain
0 s:CN = git.company.tld
i:C = US, O = Let's Encrypt, CN = R3
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
1 s:C = US, O = Let's Encrypt, CN = R3
i:O = Digital Signature Trust Co., CN = DST Root CA X3
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
---
Server certificate
subject=CN = git.company.tld
issuer=C = US, O = Let's Encrypt, CN = R3
---
No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3058 bytes and written 443 bytes
Verification error: certificate has expired
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: ...
Session-ID-ctx:
Master-Key: ...
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1632982992
Timeout : 7200 (sec)
Verify return code: 10 (certificate has expired)
Extended master secret: no
---
问题并不在于证书本身，该证书未过期，并且被Chrome（Windows 证书存储）和Firefox接受。
git config http.sslVerify false。 - michid