git/list[1] front-page[2] threads[3] people[4] search[5] about
 

RE: Problems with Windows + schannel + http.sslCert

From
Ragesh Krishna <ragesh@rageshkrishna.com>
Date
Dec 19, 2023, 10:18 UTC
Message-ID
<TY0PR06MB54426B92E745B3035F0CC2DFD197A@TY0PR06MB5442.apcprd06.prod.outlook.com>
In-Reply-To
<710affcd-f6bf-371c-d7e3-8bce3b01da3c@gmx.de>
Hi Johannes,
> However, contrary to what `git -c http.sslBackend=list ls-remote <url>` says on Windows, `git -c http.sslBackend=openssl ls-remote <url>` should work, too.
Thanks for the tip! Although I haven't made any further attempts to try and force openssl, I was able to get client auth to work with Git for Windows by ensuring the client cert and root cert are present in the Windows certificate store and then setting "http.sslCert" to "CurrentUser\\MY\\{certificate thumbprint}}". This gets everything to fall into place and I suspect that it is the "correct" way, for better or worse, to make it work on Windows.
One thing that tripped me up was that my root CA was using ed25519 for signatures, and my installation of Windows did not seem to like that one bit. Switching to ECDSA seemed to fix it. I suppose that's another rabbit hole I need to jump into, but it has nothing to do with Git :)

Regards, -- Ragesh.

Previous: Johannes Schindelin
Message 4 of 4 in “Problems with Windows + schannel + http.sslCert”
  1. Ragesh KrishnaDec 9, 2023
  2. Ragesh KrishnaDec 9, 2023
  3. Johannes SchindelinDec 13, 2023
  4. Ragesh KrishnaDec 19, 2023

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.