http.schannel.checkRevoke option is not recognized

[yopito]

• I was not able to find an open or closed issue matching what I'm seeing

Setup

• Which version of Git for Windows are you using? Is it 32-bit or 64-bit?

$ git --version --build-options
git version 2.16.2.windows.1
cpu: x86_64
built from commit: e1848984d1004040ec5199e749b5f282ddf4bb09
sizeof-long: 4

• Which version of Windows are you running? Vista, 7, 8, 10? Is it 32-bit or 64-bit?

$ cmd.exe /c ver

Microsoft Windows [version 6.1.7601]

$ echo $PROCESSOR_ARCHITECTURE
AMD64

• What options did you set as part of the installation? Or did you choose the
  defaults?

Mostly defaults:

$ git config --system -l
http.sslbackend=schannel
diff.astextplain.textconv=astextplain
filter.lfs.clean=git-lfs clean -- %f
filter.lfs.smudge=git-lfs smudge -- %f
filter.lfs.process=git-lfs filter-process
filter.lfs.required=true
credential.helper=manager

• Any other interesting things about your environment that might be related
  to the issue you're seeing?

** insert your response here **

Details

• Which terminal/shell are you running Git from? e.g Bash/CMD/PowerShell/other

git-BASH only

• What commands did you run to trigger this issue? If you can provide a
  Minimal, Complete, and Verifiable example
  this will help us understand the issue.

$ tail -n ~/.gitconfig
<snip>
    35  [http]
    36          schannel.checkRevoke = false


$ git config  -l
fatal: bad config line 36 in file C:/Users/pbourgin/.gitconfig

• What did you expect to occur after running these commands?

No error and this new option usable

• What actually happened instead?

can't set this option

• If the problem was occurring with a specific repository, can you provide the
  URL to that repository to help us with testing?

** insert URL here **

[yopito]

other hints:

• merged pull request adding http.schannel.checkRevoke support #1450 is incomplete ?
• curl version is fine:

$ curl --version
curl 7.58.0 (x86_64-w64-mingw32) libcurl/7.58.0 OpenSSL/1.0.2n (WinSSL) zlib/1.2.11 libidn2/2.0.4 nghttp2/1.29.0
Release-Date: 2018-01-24
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smtp smtps telnet tftp
Features: AsynchDNS Debug IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz TLS-SRP HTTP2 HTTPS-proxy MultiSSL Metalink

• the following config commande generates a strange config file snippset ... as expected ?

$ git config --global http.schannel.checkRevoke false

$ cat -n ~/.gitconfig
35
36  [http "schannel"]
37          checkRevoke = false

But It does not help:

$ git pull vpc
fatal: unable to access 'https://pbourgin@mycorp.com/toto.git/':  \
  schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) \
 - La fonction de r▒vocation n▒a pas pu v▒rifier la r▒vocation du certificat.

ping @shiftkey about this

[dscho]

Maybe try with GIT_TRACE_CURL=1?

[yopito]

Sorry for late reply. Using GIT_TRACE_CURL=1 does not help for this problem I think.
anyway here the traces:

• without particular settings:

$ GIT_TRACE_CURL=1 git push -u vpc --all
12:57:19.665594 http.c:656              == Info: STATE: INIT => CONNECT handle 0x701680; line 1392 (connection #-5000)
12:57:19.666594 http.c:656              == Info: Couldn't find host mycorp.com in the _netrc file; using defaults
12:57:19.666594 http.c:656              == Info: Added connection 0. The cache now contains 1 members
12:57:19.666594 http.c:656              == Info: STATE: CONNECT => WAITRESOLVE handle 0x701680; line 1428 (connection #0)
12:57:19.675594 http.c:656              == Info:   Trying 10.24.7.135...
12:57:19.675594 http.c:656              == Info: TCP_NODELAY set
12:57:19.676594 http.c:656              == Info: STATE: WAITRESOLVE => WAITCONNECT handle 0x701680; line 1509 (connection #0)
12:57:19.684594 http.c:656              == Info: Connected to mycorp.com (10.24.7.135) port 443 (#0)
12:57:19.684594 http.c:656              == Info: STATE: WAITCONNECT => SENDPROTOCONNECT handle 0x701680; line 1561 (connection #0)
12:57:19.684594 http.c:656              == Info: Marked for [keep alive]: HTTP default
12:57:19.684594 http.c:656              == Info: schannel: SSL/TLS connection with mycorp.com port 443 (step 1/3)
12:57:19.684594 http.c:656              == Info: schannel: checking server certificate revocation
12:57:19.688594 http.c:656              == Info: schannel: sending initial handshake data: sending 203 bytes...
12:57:19.688594 http.c:656              == Info: schannel: sent initial handshake data: sent 203 bytes
12:57:19.688594 http.c:656              == Info: schannel: SSL/TLS connection with mycorp.com port 443 (step 2/3)
12:57:19.688594 http.c:656              == Info: schannel: failed to receive handshake, need more data
12:57:19.688594 http.c:656              == Info: STATE: SENDPROTOCONNECT => PROTOCONNECT handle 0x701680; line 1575 (connection #0)
12:57:19.697594 http.c:656              == Info: schannel: SSL/TLS connection with mycorp.com port 443 (step 2/3)
12:57:19.697594 http.c:656              == Info: schannel: encrypted data got 1380
12:57:19.697594 http.c:656              == Info: schannel: encrypted data buffer: offset 1380 length 4096
12:57:19.698594 http.c:656              == Info: schannel: encrypted data length: 1286
12:57:19.698594 http.c:656              == Info: schannel: encrypted data buffer: offset 1286 length 4096
12:57:19.698594 http.c:656              == Info: schannel: received incomplete message, need more data
12:57:19.698594 http.c:656              == Info: schannel: SSL/TLS connection with mycorp.com port 443 (step 2/3)
12:57:19.698594 http.c:656              == Info: schannel: encrypted data got 2059
12:57:19.698594 http.c:656              == Info: schannel: encrypted data buffer: offset 3345 length 4096
12:57:19.978594 http.c:656              == Info: schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - La fonction de r¦vocation n¦a pas pu v¦rifier la ation du certificat.
12:57:19.978594 http.c:656              == Info: Marked for [closure]: Failed HTTPS connection
12:57:19.978594 http.c:656              == Info: multi_done
12:57:19.978594 http.c:656              == Info: stopped the pause stream!
12:57:19.978594 http.c:656              == Info: Closing connection 0
12:57:19.978594 http.c:656              == Info: The cache now contains 0 members
12:57:19.978594 http.c:656              == Info: schannel: shutting down SSL/TLS connection with mycorp.com port 443
12:57:19.978594 http.c:656              == Info: schannel: clear security context handle
12:57:19.979594 http.c:656              == Info: Expire cleared
fatal: unable to access 'https://pbourgin@mycorp.com/SquashTM-mig/toto.git/': schannel: next InitializeSecurityContext failed: Unknown error (0x8009 - La fonction de r¦vocation n¦a pas pu v¦rifier la r¦vocation du certificat.

• then set again the unrecognized option: no difference

$ git config --global http.schannel.checkRevoke false

$ GIT_TRACE_CURL=1 git push -u vpc --all
12:59:35.328594 http.c:656              == Info: STATE: INIT => CONNECT handle 0x891680; line 1392 (connection #-5000)
12:59:35.328594 http.c:656              == Info: Couldn't find host mycorp.com in the _netrc file; using defaults
12:59:35.328594 http.c:656              == Info: Added connection 0. The cache now contains 1 members
12:59:35.329594 http.c:656              == Info: STATE: CONNECT => WAITRESOLVE handle 0x891680; line 1428 (connection #0)
12:59:35.338594 http.c:656              == Info:   Trying 10.24.7.135...
12:59:35.338594 http.c:656              == Info: TCP_NODELAY set
12:59:35.338594 http.c:656              == Info: STATE: WAITRESOLVE => WAITCONNECT handle 0x891680; line 1509 (connection #0)
12:59:35.346594 http.c:656              == Info: Connected to mycorp.com (10.24.7.135) port 443 (#0)
12:59:35.346594 http.c:656              == Info: STATE: WAITCONNECT => SENDPROTOCONNECT handle 0x891680; line 1561 (connection #0)
12:59:35.346594 http.c:656              == Info: Marked for [keep alive]: HTTP default
12:59:35.346594 http.c:656              == Info: schannel: SSL/TLS connection with mycorp.com port 443 (step 1/3)
12:59:35.346594 http.c:656              == Info: schannel: checking server certificate revocation
12:59:35.350594 http.c:656              == Info: schannel: sending initial handshake data: sending 203 bytes...
12:59:35.350594 http.c:656              == Info: schannel: sent initial handshake data: sent 203 bytes
12:59:35.350594 http.c:656              == Info: schannel: SSL/TLS connection with mycorp.com port 443 (step 2/3)
12:59:35.350594 http.c:656              == Info: schannel: failed to receive handshake, need more data
12:59:35.350594 http.c:656              == Info: STATE: SENDPROTOCONNECT => PROTOCONNECT handle 0x891680; line 1575 (connection #0)
12:59:35.360594 http.c:656              == Info: schannel: SSL/TLS connection with mycorp.com port 443 (step 2/3)
12:59:35.360594 http.c:656              == Info: schannel: encrypted data got 1380
12:59:35.360594 http.c:656              == Info: schannel: encrypted data buffer: offset 1380 length 4096
12:59:35.360594 http.c:656              == Info: schannel: encrypted data length: 1286
12:59:35.360594 http.c:656              == Info: schannel: encrypted data buffer: offset 1286 length 4096
12:59:35.360594 http.c:656              == Info: schannel: received incomplete message, need more data
12:59:35.360594 http.c:656              == Info: schannel: SSL/TLS connection with mycorp.com port 443 (step 2/3)
12:59:35.360594 http.c:656              == Info: schannel: encrypted data got 2059
12:59:35.360594 http.c:656              == Info: schannel: encrypted data buffer: offset 3345 length 4096
12:59:35.436594 http.c:656              == Info: schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - La fonction de r¦vocation n¦a pas pu v¦rifier la r¦vocation du certificat.
12:59:35.436594 http.c:656              == Info: Marked for [closure]: Failed HTTPS connection
12:59:35.436594 http.c:656              == Info: multi_done
12:59:35.436594 http.c:656              == Info: stopped the pause stream!
12:59:35.436594 http.c:656              == Info: Closing connection 0
12:59:35.436594 http.c:656              == Info: The cache now contains 0 members
12:59:35.436594 http.c:656              == Info: schannel: shutting down SSL/TLS connection with mycorp.com port 443
12:59:35.437594 http.c:656              == Info: schannel: clear security context handle
12:59:35.437594 http.c:656              == Info: Expire cleared
fatal: unable to access 'https://pbourgin@mycorp.com/SquashTM-mig/toto.git/': schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - La fonction de r¦vocation n¦a pas pu v¦rifier la r¦vocation du certificat.

[shiftkey]

This is on my radar, just haven't had a chance to dig into it.

@yopito thanks for the GIT_TRACE_CURL=1 logs. These should help.

[zspitz]

@shiftkey Any news on this? I think I am seeing the same issue -- http.schannel.checkRevoke=true seems to be ignored.

• Which version of Git for Windows are you using? Is it 32-bit or 64-bit?

PS C:\> git --version --build-options
git version 2.17.0.windows.1
cpu: x86_64
built from commit: e7621d891d081acff6acd1f0ba6ae0adce06dd09
sizeof-long: 4

• Which version of Windows are you running?

PS C:\> cmd.exe /c ver

Microsoft Windows [Version 10.0.16299.371]
PS C:\> Get-ChildItem Env:PROCESSOR_ARCHITECTURE

Name                           Value
----                           -----
PROCESSOR_ARCHITECTURE         AMD64

• What options did you set as part of the installation? Or did you choose the
  defaults?

I can't recall offhand, but here is the full configuration from outside a specific Git-tracked folder:

PS C:\> git config --list --show-origin
file:"C:\\ProgramData/Git/config"       core.symlinks=false
file:"C:\\ProgramData/Git/config"       core.autocrlf=true
file:"C:\\ProgramData/Git/config"       core.fscache=true
file:"C:\\ProgramData/Git/config"       color.diff=auto
file:"C:\\ProgramData/Git/config"       color.status=auto
file:"C:\\ProgramData/Git/config"       color.branch=auto
file:"C:\\ProgramData/Git/config"       color.interactive=true
file:"C:\\ProgramData/Git/config"       help.format=html
file:"C:\\ProgramData/Git/config"       sendemail.smtpserver=/bin/msmtp.exe
file:"C:\\ProgramData/Git/config"       diff.astextplain.textconv=astextplain
file:"C:\\ProgramData/Git/config"       rebase.autosquash=true
file:"C:\\Program Files\\Git\\mingw64/etc/gitconfig"    http.sslcainfo=C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt
file:"C:\\Program Files\\Git\\mingw64/etc/gitconfig"    http.sslbackend=openssl
file:"C:\\Program Files\\Git\\mingw64/etc/gitconfig"    diff.astextplain.textconv=astextplain
file:"C:\\Program Files\\Git\\mingw64/etc/gitconfig"    filter.lfs.clean=git-lfs clean -- %f
file:"C:\\Program Files\\Git\\mingw64/etc/gitconfig"    filter.lfs.smudge=git-lfs smudge -- %f
file:"C:\\Program Files\\Git\\mingw64/etc/gitconfig"    filter.lfs.process=git-lfs filter-process
file:"C:\\Program Files\\Git\\mingw64/etc/gitconfig"    filter.lfs.required=true
file:"C:\\Program Files\\Git\\mingw64/etc/gitconfig"    credential.helper=manager
file:C:/Users/win8/.gitconfig   user.name=Zev Spitz
file:C:/Users/win8/.gitconfig   user.email=__________@__________
file:C:/Users/win8/.gitconfig   filter.lfs.required=true
file:C:/Users/win8/.gitconfig   filter.lfs.clean=git-lfs clean -- %f
file:C:/Users/win8/.gitconfig   filter.lfs.smudge=git-lfs smudge -- %f
file:C:/Users/win8/.gitconfig   http.sslbackend=schannel
file:C:/Users/win8/.gitconfig   http.schannel.checkrevoke=false

• Any other interesting things about your environment that might be related
  to the issue you're seeing?

My ISP provides a content filter which works even over SSL. I've installed the ISP-provided security certificate to Windows, but not to Git (e.g. via http.sslCAInfo or http.sslCAPath). My understanding is that as I've set http.sslBackend to schannel, Git for Windows will make use of said certificate; is this correct?

• Which terminal/shell are you running Git from? e.g Bash/CMD/PowerShell/other

CMD; Powershell from the VS Code integrated terminal

• What commands did you run to trigger this issue?

PS D:\Zev\Projects\_typescript\DefinitelyTyped> git pull upstream master

---

I have the following trace, after $env:GIT_CURL_VERBOSE=1:

PS D:\Zev\Projects\_typescript\DefinitelyTyped> git pull upstream master
* STATE: INIT => CONNECT handle 0x5709840; line 1392 (connection #-5000)
* Couldn't find host github.com in the _netrc file; using defaults
* Added connection 0. The cache now contains 1 members
* STATE: CONNECT => WAITRESOLVE handle 0x5709840; line 1428 (connection #0)
*   Trying 192.30.253.113...
* TCP_NODELAY set
* STATE: WAITRESOLVE => WAITCONNECT handle 0x5709840; line 1509 (connection #0)
* Connected to github.com (192.30.253.113) port 443 (#0)
* STATE: WAITCONNECT => SENDPROTOCONNECT handle 0x5709840; line 1561 (connection #0)
* Marked for [keep alive]: HTTP default
* schannel: SSL/TLS connection with github.com port 443 (step 1/3)
* schannel: checking server certificate revocation
* schannel: sending initial handshake data: sending 175 bytes...
* schannel: sent initial handshake data: sent 175 bytes
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: failed to receive handshake, need more data
* STATE: SENDPROTOCONNECT => PROTOCONNECT handle 0x5709840; line 1575 (connection #0)
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: encrypted data got 1360
* schannel: encrypted data buffer: offset 1360 length 4096
* schannel: encrypted data length: 1290
* schannel: encrypted data buffer: offset 1290 length 4096
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: encrypted data got 1360
* schannel: encrypted data buffer: offset 2650 length 4096
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: encrypted data got 1376
* schannel: encrypted data buffer: offset 4026 length 4096
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: encrypted data got 1024
* schannel: encrypted data buffer: offset 5050 length 5050
* schannel: encrypted data length: 495
* schannel: encrypted data buffer: offset 495 length 5050
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: encrypted data got 75
* schannel: encrypted data buffer: offset 570 length 5050
* schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate.
* Marked for [closure]: Failed HTTPS connection
* multi_done
* stopped the pause stream!
* Closing connection 0
* The cache now contains 0 members
* schannel: shutting down SSL/TLS connection with github.com port 443
* schannel: clear security context handle
* Expire cleared
fatal: unable to access 'https://github.com/DefinitelyTyped/DefinitelyTyped.git/': schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate.

[riezebosch]

See my comment: 55c268f#r28965974

(credits to a colleague)

[agusmba]

Thank you all for tackling this issue, it's not easy to work with git and https in a windows box.

I updated to the latest git version (2.17.1.windows.2) but I'm still seeing this problem:

$ git config --list --show-origin | grep http
file:C:/Program Files/Git/mingw64/etc/gitconfig http.sslbackend=schannel
file:d:/home/user/.gitconfig        http.emptyauth=true
file:d:/home/user/.gitconfig        http.sslbackend=schannel
file:d:/home/user/.gitconfig        credential.my.server.com.usehttppath=true
file:d:/home/user/.gitconfig        http.schannel.checkrevoke=false
file:.git/config        remote.origin.url=https://user@my.server.com/bitbucket/scm/~user/repository.git

$ GIT_CURL_VERBOSE=1 GIT_TRACE_CURL=1 git fetch -vvv
11:32:11.906524 http.c:709              == Info: Couldn't find host my.server.com in the _netrc file; using defaults
11:32:11.922125 http.c:709              == Info:   Trying 10.xxx.xxx.x...
11:32:11.922125 http.c:709              == Info: TCP_NODELAY set
11:32:11.922125 http.c:709              == Info: Connected to my.server.com (10.xxx.xxx.x) port 443 (#0)
11:32:11.922125 http.c:709              == Info: schannel: SSL/TLS connection with gestioncodigo.sco.ree.es port 443 (step 1/3)
11:32:11.922125 http.c:709              == Info: schannel: checking server certificate revocation
11:32:11.937725 http.c:709              == Info: schannel: sending initial handshake data: sending 197 bytes...
11:32:11.937725 http.c:709              == Info: schannel: sent initial handshake data: sent 197 bytes
11:32:11.937725 http.c:709              == Info: schannel: SSL/TLS connection with my.server.com port 443 (step 2/3)
11:32:11.937725 http.c:709              == Info: schannel: failed to receive handshake, need more data
11:32:11.937725 http.c:709              == Info: schannel: SSL/TLS connection with my.server.com port 443 (step 2/3)
11:32:11.937725 http.c:709              == Info: schannel: encrypted data got 2008
11:32:11.937725 http.c:709              == Info: schannel: encrypted data buffer: offset 2008 length 4096
11:32:11.937725 http.c:709              == Info: schannel: next InitializeSecurityContext failed: Unknown error (0x80092013) - La función de revocación no puede comprobar la revocación debido a que el servidor de revocación está sin conexión.
11:32:11.937725 http.c:709              == Info: stopped the pause stream!
11:32:11.937725 http.c:709              == Info: Closing connection 0
11:32:11.937725 http.c:709              == Info: schannel: shutting down SSL/TLS connection with my.server.com port 443
11:32:11.937725 http.c:709              == Info: schannel: clear security context handle
fatal: unable to access 'https://user@my.server.com/bitbucket/scm/~user/repository.git/': schannel: next InitializeSecurityContext failed: Unknown error (0x80092013) - La función de revocación no puede comprobar la revocación debido a que el servidor de revocación está sin conexión.

Curl version should be ok:

$ curl --version
curl 7.60.0 (x86_64-w64-mingw32) libcurl/7.60.0 OpenSSL/1.0.2o (WinSSL) zlib/1.2.11 libidn2/2.0.5 nghttp2/1.31.1
Release-Date: 2018-05-16
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz TLS-SRP HTTP2 HTTPS-proxy MultiSSL Metalink

@zspitz is it working for you?

Thanks!

[dscho]

@agusmba it should be fixed in the 2.18.0-rc2 prerelease. v2.18.0 was supposed to come out last night, but slipped, it will probably be there soon.

[agusmba]

Hi @dscho, thanks for the answer!

Today I updated to 2.18.0 via git update-... but I still got the same error as before.
Is there any way I could help by getting more detailed logs somehow?

Just in case I also uninstalled git completely and reinstalled it with the newest installer (2.18.0) to no avail.