修复 SSL Certificate Problem，如何定位及解决问题

# On Linux
export GIT_CURL_VERBOSE=1
export GIT_TRACE_PACKET=1
export GIT_TRACE=1

# On Window
set GIT_TRACE_PACKET=1
set GIT_TRACE=1 
set GIT_CURL_VERBOSE=1

# 如果当前机器有安装 python，可以快速检查证书路径，辅助定位解决问题
python -c "import ssl; print(ssl.get_default_verify_paths())" 

# 使用 openssl 检查站点的证书情况
openssl s_client -showcerts -connect

# 使用 git 操作的全局处理措施
# http.sslBackend: Name of the SSL backend to use (e.g. "openssl" or "schannel"). 
# This option is ignored if cURL lacks support for choosing the SSL backend at runtime.
git config --global http.sslBackend schannel

# 或者
# http.sslVerify: A boolean to enable/disable verification of the server certificate used by the SSL/TLS connection.
# ⚠️ Do NOT do this!
git config --global http.sslVerify false

# 亦可以直接设置环境变量运行 git 操作
GIT_SSL_NO_VERIFY=true git clone https://username@git.example.com/scm/repository.git

# Git Config Option Ref: https://git-scm.com/docs/git-config

# Convert the file into the X.509 format
# openssl-x509, x509 - Certificate display and signing utility
# https://www.openssl.org/docs/man1.0.2/man1/x509.html
openssl x509 -in certificate.pem -out certificate.crt
git config --system http.sslCAInfo /path/certificate.crt

# 或者可以修改 .gitconfig 的配置项目，然后重新安装一下 git
git config --global -e

[http "https://your.domain.com"]
  # MUST be PEM format
  # Some situations require both the CAPath AND CAInfo 
  sslCAInfo = /path/to/selfCA/self-signed-certificate.crt
  sslCAPath = /path/to/selfCA/
  sslVerify = true

  # Must be PEM format and include BEGIN CERTIFICATE / END CERTIFICATE, 
  # not just the BEGIN PRIVATE KEY / END PRIVATE KEY for Git to recognise it.
  sslCert = /path/to/privatekey/myprivatecert.pem

  # Even if your PEM file is password protected, set this to false.
  # Setting this to true always asks for a password even if you don't have one.
  # When you do have a password, even with this set to false it will prompt anyhow. 
  sslCertPasswordProtected = 0

# curl code:
	curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);

# python package
pip config set global.cert path/to/ca-bundle.crt

# conda package
conda config --set ssl_verify path/to/ca-bundle.crt

# 编辑文件 /etc/ca-certificates.conf, 找到该证书并注释
!mozilla/DST_Root_CA_X3.crt

# 或者直接命令行处理
sudo sed -i -e 's/mozilla\/DST_Root_CA_X3\.crt/!mozilla\/DST_Root_CA_X3\.crt/g' /etc/ca-certificates.conf

# 保存文件后运行命令
sudo rm /usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt
sudo update-ca-certificates

sudo certbot renew --force-renewal --preferred-chain "ISRG Root X1"