{"thread":{"id":"60600","subject":"Problems with Windows + schannel + http.sslCert","startedAt":"2023-12-09T17:38:55Z","lastAt":"2023-12-19T10:18:28Z","messageCount":4,"participants":["Ragesh Krishna","Johannes Schindelin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"485506","messageId":"TY0PR06MB544239787E909DD4EAC1CA42D189A@TY0PR06MB5442.apcprd06.prod.outlook.com","threadId":"60600","inReplyTo":null,"subject":"Problems with Windows + schannel + http.sslCert","fromName":"Ragesh Krishna","fromEmail":"ragesh@rageshkrishna.com","sentAt":"2023-12-09T17:37:47Z","receivedAt":"2023-12-09T17:38:55Z","isPatch":false,"sender":{"key":"ragesh@rageshkrishna.com","avatar":"https://gravatar.com/avatar/0a135ec715d39620179e368172da4ac0c073858d0db9f45074948d6c3202e5f7?d=mp&s=160"},"body":"Hi folks,\n\nI'm trying to use SSL client auth on Windows. My git installation currently lists only schannel as the supported backend. The problem is that this always gives me \"fatal: refusing to work with credential missing host field\". I can see from my server at the other end that a connection was attempted and then terminated unexpectedly. However, I'm not sure what git is expecting me to do to make this work. I suspect it is an schannel vs. openssl difference, because the same credentials work fine on a linux machine. Is there something I can do to dig deeper and understand why this is failing?\n\nThanks,\n-- Ragesh.\n"},{"id":"485507","messageId":"TY0PR06MB5442CF7CC4F1952500E8C98AD189A@TY0PR06MB5442.apcprd06.prod.outlook.com","threadId":"60600","inReplyTo":"TY0PR06MB544239787E909DD4EAC1CA42D189A@TY0PR06MB5442.apcprd06.prod.outlook.com","subject":"RE: Problems with Windows + schannel + http.sslCert","fromName":"Ragesh Krishna","fromEmail":"ragesh@rageshkrishna.com","sentAt":"2023-12-09T17:53:14Z","receivedAt":"2023-12-09T17:53:22Z","isPatch":false,"sender":{"key":"ragesh@rageshkrishna.com","avatar":"https://gravatar.com/avatar/0a135ec715d39620179e368172da4ac0c073858d0db9f45074948d6c3202e5f7?d=mp&s=160"},"body":"Please ignore. Further research suggests that this is an issue with curl on Windows not yet supporting client auth with the schannel backend. Sorry for the noise.\n\n-- Ragesh.\n\n-----Original Message-----\nFrom: Ragesh Krishna \nSent: Saturday, December 9, 2023 11:08 PM\nTo: git@vger.kernel.org\nSubject: Problems with Windows + schannel + http.sslCert\n\nHi folks,\n\nI'm trying to use SSL client auth on Windows. My git installation currently lists only schannel as the supported backend. The problem is that this always gives me \"fatal: refusing to work with credential missing host field\". I can see from my server at the other end that a connection was attempted and then terminated unexpectedly. However, I'm not sure what git is expecting me to do to make this work. I suspect it is an schannel vs. openssl difference, because the same credentials work fine on a linux machine. Is there something I can do to dig deeper and understand why this is failing?\n\nThanks,\n-- Ragesh.\n"},{"id":"485612","messageId":"710affcd-f6bf-371c-d7e3-8bce3b01da3c@gmx.de","threadId":"60600","inReplyTo":"TY0PR06MB544239787E909DD4EAC1CA42D189A@TY0PR06MB5442.apcprd06.prod.outlook.com","subject":"Re: Problems with Windows + schannel + http.sslCert","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2023-12-13T11:56:35Z","receivedAt":"2023-12-13T11:56:43Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Ragesh,\n\nOn Sat, 9 Dec 2023, Ragesh Krishna wrote:\n\n> I'm trying to use SSL client auth on Windows. My git installation\n> currently lists only schannel as the supported backend.\n\nThere is a reason why only Secure Channel is listed as supported backend,\nand it is a relatively boring one: DLL hell.\n\nHowever, contrary to what `git -c http.sslBackend=list ls-remote <url>`\nsays on Windows, `git -c http.sslBackend=openssl ls-remote <url>` should\nwork, too.\n\nCiao,\nJohannes\n"},{"id":"485808","messageId":"TY0PR06MB54426B92E745B3035F0CC2DFD197A@TY0PR06MB5442.apcprd06.prod.outlook.com","threadId":"60600","inReplyTo":"710affcd-f6bf-371c-d7e3-8bce3b01da3c@gmx.de","subject":"RE: Problems with Windows + schannel + http.sslCert","fromName":"Ragesh Krishna","fromEmail":"ragesh@rageshkrishna.com","sentAt":"2023-12-19T10:18:23Z","receivedAt":"2023-12-19T10:18:28Z","isPatch":false,"sender":{"key":"ragesh@rageshkrishna.com","avatar":"https://gravatar.com/avatar/0a135ec715d39620179e368172da4ac0c073858d0db9f45074948d6c3202e5f7?d=mp&s=160"},"body":"Hi Johannes,\n\n> However, contrary to what `git -c http.sslBackend=list ls-remote <url>` says on Windows, `git -c http.sslBackend=openssl ls-remote <url>` should work, too.\n\nThanks for the tip! Although I haven't made any further attempts to try and force openssl, I was able to get client auth to work with Git for Windows by ensuring the client cert and root cert are present in the Windows certificate store and then setting \"http.sslCert\" to \"CurrentUser\\\\MY\\\\{certificate thumbprint}}\". This gets everything to fall into place and I suspect that it is the \"correct\" way, for better or worse, to make it work on Windows.\n\nOne thing that tripped me up was that my root CA was using ed25519 for signatures, and my installation of Windows did not seem to like that one bit. Switching to ECDSA seemed to fix it. I suppose that's another rabbit hole I need to jump into, but it has nothing to do with Git :)\n\nRegards,\n-- Ragesh.\n"}]}