Problems with Windows + schannel + http.sslCert

Hi folks,

I'm trying to use SSL client auth on Windows. My git installation currently lists only schannel as the supported backend. The problem is that this always gives me "fatal: refusing to work with credential missing host field". I can see from my server at the other end that a connection was attempted and then terminated unexpectedly. However, I'm not sure what git is expecting me to do to make this work. I suspect it is an schannel vs. openssl difference, because the same credentials work fine on a linux machine. Is there something I can do to dig deeper and understand why this is failing?

Thanks, -- Ragesh.

Please ignore. Further research suggests that this is an issue with curl on Windows not yet supporting client auth with the schannel backend. Sorry for the noise.

-- Ragesh.

-----Original Message-----
From: Ragesh Krishna 
Sent: Saturday, December 9, 2023 11:08 PM
To: git@vger.kernel.org
Subject: Problems with Windows + schannel + http.sslCert

Hi folks,

I'm trying to use SSL client auth on Windows. My git installation currently lists only schannel as the supported backend. The problem is that this always gives me "fatal: refusing to work with credential missing host field". I can see from my server at the other end that a connection was attempted and then terminated unexpectedly. However, I'm not sure what git is expecting me to do to make this work. I suspect it is an schannel vs. openssl difference, because the same credentials work fine on a linux machine. Is there something I can do to dig deeper and understand why this is failing?

Thanks, -- Ragesh.

Hi Ragesh,

On Sat, 9 Dec 2023, Ragesh Krishna wrote:

There is a reason why only Secure Channel is listed as supported backend, and it is a relatively boring one: DLL hell.

However, contrary to what `git -c http.sslBackend=list ls-remote <url>` says on Windows, `git -c http.sslBackend=openssl ls-remote <url>` should work, too.

Ciao, Johannes

Hi Johannes,

Thanks for the tip! Although I haven't made any further attempts to try and force openssl, I was able to get client auth to work with Git for Windows by ensuring the client cert and root cert are present in the Windows certificate store and then setting "http.sslCert" to "CurrentUser\\MY\\{certificate thumbprint}}". This gets everything to fall into place and I suspect that it is the "correct" way, for better or worse, to make it work on Windows.

One thing that tripped me up was that my root CA was using ed25519 for signatures, and my installation of Windows did not seem to like that one bit. Switching to ECDSA seemed to fix it. I suppose that's another rabbit hole I need to jump into, but it has nothing to do with Git :)

Regards, -- Ragesh.