8000 Support for disabling certificate revocation checks on schannel · Issue #6724 · libgit2/libgit2 · GitHub
[go: up one dir, main page]
Skip to content

Support for disabling certificate revocation checks on schannel #6724

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
jeroen-mostert opened this issue Jan 23, 2024 · 2 comments
Open

Support for disabling certificate revocation checks on schannel #6724

jeroen-mostert opened this issue Jan 23, 2024 · 2 comments

Comments

@jeroen-mostert
Copy link

I'm on Windows (10.0.19045.3930, if it matters) and using libgit2sharp 0.29, which switched to libgit2 1.7.1. 1.7.0 introduced (optional, configurable?) schannel support, which I'm suspecting is causing my problem: attempting to clone fails with a "certificate revocation status could not be verified" error. I can reproduce this with command-line git (2.43.0) if I explicitly set the option http.schannelCheckRevoke to true, which then gives schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate. This is odd in itself, because according to the docs, this should be the default anyway. But sure enough, if I unset the option, or explicitly set it to false, command-line git as well as libgit2sharp 0.28 clone just fine.

This can of course be worked around in various ways, including making revocation work (somehow) or overriding certificate checking with a callback and re-doing the verification myself with revocation checking turned off (clunky as that is), but I suspect that in order for this to work through configuration as it does now, libgit2 would need explicit support for the http.schannelCheckRevoke option and it currently doesn't have it, correct?

Apologies for not supplying a full repro; this would require both setting up a failing revocation through schannel as well as conjuring up code for calling libgit2 directly. I think I'm at least correct in locating the issue in libgit2 rather than libgit2sharp.
@csware
Copy link
Contributor
csware commented Feb 24, 2024

May this depend on the configured internet options of (Internet Explorer|Windows)?

@lrm29
Copy link
Contributor
lrm29 commented Nov 15, 2024

We've hit this too in a sense although the error is:

unknown certificate lookup failure 16777280 (-1x16)

I found out that http.schannelCheckRevoke in Git for Windows does NOT default to true. It defaults to "best-effort". This means that these error states are ignored: CERT_TRUST_REVOCATION_STATUS_UNKNOWN, CERT_TRUST_IS_OFFLINE_REVOCATION.

So on Windows libgit2 should probably do the same. I'd probably split this into:

  • Ignore the errors on Windows
  • add support for http.schannelCheckRevoke
  • set_certificate_lookup_error treats "status" as an enum but it's a bitmask (we saw the error "unknown certificate lookup failure" but actually it should have been "certificate revocation status could not be verified" AND "certificate revocation is offline or stale"

@lrm29 lrm29 mentioned this issue Nov 17, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@lrm29 @csware @jeroen-mostert
0