SQLITE_ERROR(1): no such table: global_config in "REPLACE INTO global_config(name,value) ...

Not sure this will help, but try setting some global config option first:

fossil config set --global web-browser /usr/bin/true
fossil config unset --global web-browser

That "should" ensure that the config db is in place. If your clone still fails, we then know that the config is in place but is probably not being opened at the right time.

subject: C = US, ST = Nevada, L = Las Vegas, O = user, OU = Provisional CA, CN = localhost

My home town.

Not sure this will help, but try setting some global config option first:

fossil config set --global web-browser /usr/bin/true

$ fossil config set --global web-browser /usr/bin/true
use --repository or -R to specify the repository database

This doesn't return an error: fossil set --global web-browser /usr/bin/true

But unset doesn't work:

$ fossil unset --global web-browser /usr/bin/true
Usage: fossil unset PROPERTY ?-global?

At any rate, I still get the error when cloning. I'm only guessing the self-signed cert is causing the problems.

My home town.

Yep! I saw that on your homepage a couple years back. I've been here longer than I thought I would be living in the desert. The mountains are very nice to look and explore, though.

But unset doesn't work:

The unset command doesn’t have any argument after the property name. (Remove /usr/bin/true)

But unset doesn't work:

Copy/paste error on my part. Martin's response is correct.

At any rate, I still get the error when cloning. I'm only guessing the self-signed cert is causing the problems.

Maybe, but possibly only indirectly. It's complaining that it can't find the table from the global config (which we know is there because your set worked). i'll poke at it but am unfamiliar with that area of the code so make no promises.

Unable to verify SSL cert from ...

Sean, can you please try adding, directly above this line:

src:/file?ci=trunk&name=src/http_ssl.c&ln=402

This one line:

db_open_config(0, 0);

???

So that block would then look like:

      if( cReply=='y' || cReply=='Y') {
        db_open_config(0, 0); /* THIS IS NEW */
        ssl_remember_certificate_exception(pUrlData, zHash);
      }

i think that's what needs to happen but am not familiar enough with SSL handling to come up with a local reproduction case.

i think that's what needs to happen but am not familiar enough with SSL handling to come up with a local reproduction case.

Good news!

The code compiles and I'm able to clone the repos.

One peculiar thing is, for each repo I cloned, I needed to accept the same self-signed cert.

I'm fine with you holding off with committing this change so that others can review and see if there's a different approach to take. I was able to clone my repos and that's what I wanted to do today!

The code compiles and I'm able to clone the repos.

:-D

One peculiar thing is, for each repo I cloned, I needed to accept the same self-signed cert.

Hmmm. i'll take a look at that later on but may have to defer that one to someone who's more familiar with the cert handling, namely Richard or Warren.

You can save yourself a lot of hassle with self-signed certs if you sign them with a self-created root CA cert with a long lifetime (traditionally 3650 days) that you import into the local CA root trust store. This way, every time you create another cert signed by that root, it's automatically trusted.

When you create the root CA cert, you mark it as only allowed to sign other certs. That is, you deliberately do not give it the ability to do TLS authentication, IPSEC, code signing, S/MIME, etc. When you need such a cert, you sign it with this root cert; the root itself can't act in these roles.

Also, you hide the private half away securely. Only the public half gets inserted into the CA root trust store on each machine you need this to work on.

I have a smart router that does this as part of all the other network geekery it can do, so the private CA root cert lives in only two places: inside that device and in encrypted backups of that device's configuration.

You can save yourself a lot of hassle with self-signed certs if you sign them with a self-created root CA cert with a long lifetime (traditionally 3650 days) that you import into the local CA root trust store.

Good tip indeed. I setup fossil on windows with stunnel and self sign cert to follow the fossil docs about this setup.

It was no problem setting up or browsing my repos locally, which has been working for at least half a year. I think this was the first time I attempted a clone since the setup.