Package: mercurial Version: 4.8.2-1 Followup-For: Bug #918475 Hello, i am also getting the same error on my sid system and after asking from #debian/#debian-next tried a bit more.
openssl s_client -connect api.media.atlassian.com:443 is enough to get same error message. So topic should maybe be moved to openssl package. Trying various versions from snapshot.debian.net (withou touching openssl.conf (downgrading both libssl1.1+openssl packages) Last working: 1.1.1~~pre4 First failing: 1.1.1~~pre6-2 (-1 does not have binaries on snapshot.debian.net) Change triggering the issue seems to be the SecurityLevel change in /etc/ssl/openssl.conf Commenting out this line on unmodified sid with latest libssl/openssl is enough to make connection work. Also lowering minTLS version from 1.2 to 1.10 without touching Cipersuite makes connection work again. Reading i.e. https://wiki.debian.org/ContinousIntegration/TriagingTips/openssl-1.1.1 page i don't understand the problem as the server config in atlassian looks fine to not use any low grade security and s_client connects with: TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Apart atlassian recently changed their config to raise min-version of their bitbucket.org hosting to be TLSv1.2 (note that host talked about in this issue is related to that service (used in their clonebundles). -- System Information: Debian Release: buster/sid APT prefers unstable-debug APT policy: (500, 'unstable-debug'), (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.19.0-1-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages mercurial depends on: ii libc6 2.28-5 ii mercurial-common 4.8.2-1 ii python 2.7.15-4 ii ucf 3.0038+nmu1 Versions of packages mercurial recommends: ii openssh-client 1:7.9p1-5 Versions of packages mercurial suggests: ii meld 3.20.0-1 pn qct <none> -- no debconf information