First of all: you are right, we should not try to get the password if http.sslKey is not set. I'll move the code into the if clause.

Regarding the second part I am not so sure whether we should adopt C Git behaviour. If I understood that correctly C Git will rely on OpenSSL to prompt the user if sslCertPasswordProtected is not set. If it is set C Git on his own may prompt in advance. But in our case we don't have a underlying layer which may prompt. If JGit doesn't trigger the prompt nobody will do, or? So if we would set sslCertPasswordProtected to false we'll fail if a password is required (in contrast to what would happen with CGit).