<p>Been hit by this just today after a fresh install so here's how I got over it:</p>

<p>From your logs (emphasis is mine):</p>

<blockquote>
  <p>fatal: unable to access ... : <strong>schannel</strong>: next InitializeSecurityContext failed:</p>
</blockquote>

<p>git is configured to use schannel (windows native implementation), but schannel use windows certs bundle and not a the cainfo bundle.</p>

<p>To switch to openssl to use a custom bundle file use this:</p>

<p><code>git config --system http.sslbackend openssl</code></p>

<p>And now git will honor the CA bundle passed in http.sslcainfo.</p>

<p>Alternatively as my error was a problem of cypher suite you may be interested by the following links:</p>

<ul>
<li><a href="https://support.microsoft.com/en-us/help/3161639" rel="nofollow noreferrer">https://support.microsoft.com/en-us/help/3161639</a></li>
<li>in case you have still an old system (Win2k3) <a href="https://support.microsoft.com/en-us/help/948963/an-update-is-available-to-add-support-for-the-tls-rsa-with-aes-128-cbc" rel="nofollow noreferrer">https://support.microsoft.com/en-us/help/948963/an-update-is-available-to-add-support-for-the-tls-rsa-with-aes-128-cbc</a></li>
</ul>

CC BY-SA 3.0
2017-11-17T10:04:07.120Z
2017-11-17T10:37:47.613Z
2017-11-17T10:37:47.613Z
Tensibai
<p>I had something similar a year ago, so I hope I remember -</p>

<p>You should have all the certificate chain in the crt file. Verify that you have all the intermediate certificates between your bitbucket certificate and the root one (inclusive).</p>

<p>You can have a look at the correct format for appending them in the pem format (which I believe is your case with the crt) over <a href="https://www.digicert.com/ssl-support/pem-ssl-creation.htm" rel="nofollow noreferrer">here</a>.</p>

<p>My certificate was signed by Comodo when I had that issue, their certificate and the intermediate weren't in the default ca-bundle supplied by most systems.</p>

<p>Hope that helps!</p>

<p><strong>Edit:</strong> Now I noticed it happens also with the fake one - try to check the systems default known certificates (each system has such). On windows you can go to the <a href="https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-view-certificates-with-the-mmc-snap-in" rel="nofollow noreferrer">Windows Certificates mmc snap-in</a>.</p>

CC BY-SA 3.0
2017-08-31T21:44:25.253Z
2017-08-31T21:49:28.057Z
2017-08-31T21:49:28.057Z
arieljannai
<p>all, I have a working certificates chain (testable with OpenSSL) but somehow I cannot manage to tell Git to load these certificates. </p>

<p>I get <strong>the same</strong> "untrusted root authority" error (SEC_E_UNTRUSTED_ROOT) <strong>independently</strong> of whether my git configuration points to an existing or a fake certificate chain file.</p>

<p>For details, please check the attached screenshot.<a href="https://i.sstatic.net/dB3ft.png" rel="noreferrer"><img src="https://i.sstatic.net/dB3ft.png" alt="enter image description here"></a></p>

<p>Setting I use in <code>.gitconfig</code> for fake file:</p>

<pre><code>sslCAInfo = C:/tmp/foobar.crt
</code></pre>

<p>or, for real file which works with OpenSSL:</p>

<pre><code>sslCAInfo = C:/tmp/ca-bundle.crt
</code></pre>

<p>Console transcript:</p>

<pre><code>C:\tmp&gt;openssl version
OpenSSL 0.9.8h 28 May 2008

C:\tmp&gt;git --version
git version 2.12.2.windows.2

C:\tmp&gt;git config --list
http.sslverify=true
http.sslcainfo=C:/tmp/ca-bundle.crt

C:\tmp&gt;dir
24.04.2017 13:45 10.875 ca-bundle.crt

c:\tmp&gt;openssl s_client -state -connect https://mygithost:443 -CAfile .\ca-bundle.crt

Verify return code: 0 (ok)

C:\tmp git clone https://mygithost/bitbucket/scm/my.git
Cloning into ...
fatal: unable to access ... : schannel: next InitializeSecurityContext failed: SEC_E_UNTRUSTED_ROOT (0x80090325) - The certificate chain was issued by an authority that is not trusted.

C:\tmp&gt; git -c http.sslverify=false clone https://mygithost/bitbucket/scm/my.git
Cloning into ...
Resoliving deltas: 100%, done.

C:\tmp&gt;git config --list
http.sslverify=true
http.sslcainfo=C:/tmp/foobar.crt

C:\tmp\xxx\git pull
fatal: unable to access ... : schannel: next InitializeSecurityContext failed: SEC_E_UNTRUSTED_ROOT (0x80090325) - The certificate chain was issued by an authority that is not trusted.
</code></pre>

CC BY-SA 3.0
2017-04-27T07:09:13.943Z
You have a typo in your git configuration : tml instead of tmp
Tensibai
CC BY-SA 3.0
2017-04-27T07:26:54.577Z
I find it strange git does not raise an error with fakepath.  You should verify other configuration levels (global,  user and repo) there's probably a fallback somewhere
Tensibai
CC BY-SA 3.0
2017-04-27T08:50:08.273Z
@Tensibai please provide instructions or a link to docs, not sure how to print out all that. e.g. git config --global --list does not work.
Ta Mu
CC BY-SA 3.0
2017-04-27T09:13:09.110Z
Git config --get-all should do to show every resulting configuration from system,  global and local (can't verify I'm on phone, and that's just a guess, workaround  could be `set SSL_CERT_FILE=C:\tmp\ca-bundle.crt` to tell openssl where to find the bundle
Tensibai
CC BY-SA 3.0
2017-05-03T10:48:44.753Z
`C:\git config --get-all--          =>  error: wrong number of arguments`
Ta Mu
CC BY-SA 3.0
2017-05-03T11:20:45.363Z
Get-all takes a regex,  try with .* as parameter
Tensibai
CC BY-SA 3.0
2017-05-03T13:27:56.643Z
`error: key does not contain a section: .* `
Ta Mu
CC BY-SA 3.0
2017-05-03T16:13:20.933Z
OK,  I'm sorry I don't have git on phone to get the proper command to copy paste.  I had hope you'll try a little harder by yourself...
Tensibai
CC BY-SA 3.0
2017-06-08T12:56:22.767Z
Try `git config -l`, `git config -l --global`, `git config -l --system` and `got config -l --local` to see each level of configuration
Tensibai
CC BY-SA 3.0
2017-06-13T16:50:32.497Z
Any update on this? Having the same problem.
derivation
CC BY-SA 3.0
2017-07-10T15:35:35.217Z
@tensibai interestingly, only the first command works, the other are not accepted by git. ("only one config at a time", it says.  On the first, it indeed does not read the global config. 
Anyway I have upgraded to Windows 10 and git 2.13.2, so the quesion is no more relevant for myself. Shall I just let it here?
Ta Mu
CC BY-SA 3.0
2017-07-10T15:46:58.710Z
Sounds strange it doesn't accept a level to show the configuration at all. Well, seems other are interested in this question bu no one has a solution. I, for my part, have no problem with internal root CA used to sign our MITM proxy certificate or our internal gitlab server, so I can't reproduce it.
Tensibai
CC BY-SA 3.0
2017-07-10T15:48:07.703Z
but does your git version support those tags for levels?
Ta Mu
<git><windows><ssl>
Git seems to recognize http.sslcainfo property from .gitconfig but ignores it on execution? SEC_E_UNTRUSTED_ROOT
Ta Mu
# Git seems to recognize http.sslcainfo property from .gitconfig but ignores it on execution? SEC_E_UNTRUSTED_ROOT

(Asked by: username_0 on 2017-04-26)

all, I have a working certificates chain (testable with OpenSSL) but somehow I cannot manage to tell Git to load these certificates. 
I get the same "untrusted root authority" error (SEC_E_UNTRUSTED_ROOT) independently of whether my git configuration points to an existing or a fake certificate chain file.
For details, please check the attached screenshot.
Setting I use in .gitconfig for fake file:
sslCAInfo = C:/tmp/foobar.crt

or, for real file which works with OpenSSL:
sslCAInfo = C:/tmp/ca-bundle.crt

Console transcript:
C:\tmp>openssl version
OpenSSL 0.9.8h 28 May 2008

C:\tmp>git --version
git version 2.12.2.windows.2

C:\tmp>git config --list
http.sslverify=true
http.sslcainfo=C:/tmp/ca-bundle.crt

C:\tmp>dir
24.04.2017 13:45 10.875 ca-bundle.crt

c:\tmp>openssl s_client -state -connect https://mygithost:443 -CAfile .\ca-bundle.crt

Verify return code: 0 (ok)

C:\tmp git clone https://mygithost/bitbucket/scm/my.git
Cloning into ...
fatal: unable to access ... : schannel: next InitializeSecurityContext failed: SEC_E_UNTRUSTED_ROOT (0x80090325) - The certificate chain was issued by an authority that is not trusted.

C:\tmp> git -c http.sslverify=false clone https://mygithost/bitbucket/scm/my.git
Cloning into ...
Resoliving deltas: 100%, done.

C:\tmp>git config --list
http.sslverify=true
http.sslcainfo=C:/tmp/foobar.crt

C:\tmp\xxx\git pull
fatal: unable to access ... : schannel: next InitializeSecurityContext failed: SEC_E_UNTRUSTED_ROOT (0x80090325) - The certificate chain was issued by an authority that is not trusted.

**Tags:** git, windows, ssl

> **Comments:**
> **username_1**: You have a typo in your git configuration : tml instead of tmp  
> **username_1**: I find it strange git does not raise an error with fakepath.  You should verify other configuration levels (global,  user and repo) there's probably a fallback somewhere  
> **username_0**: @username_1 please provide instructions or a link to docs, not sure how to print out all that. e.g. git config --global --list does not work.  
> **username_1**: Git config --get-all should do to show every resulting configuration from system,  global and local (can't verify I'm on phone, and that's just a guess, workaround  could be `set SSL_CERT_FILE=C:\tmp\ca-bundle.crt` to tell openssl where to find the bundle  
> **username_0**: `C:\git config --get-all--          =>  error: wrong number of arguments`  
> **username_1**: Get-all takes a regex,  try with .* as parameter  
> **username_0**: `error: key does not contain a section: .* `  
> **username_1**: OK,  I'm sorry I don't have git on phone to get the proper command to copy paste.  I had hope you'll try a little harder by yourself...  
> **username_1**: Try `git config -l`, `git config -l --global`, `git config -l --system` and `got config -l --local` to see each level of configuration  
> **username_2**: Any update on this? Having the same problem.  
> **username_0**: @tensibai interestingly, only the first command works, the other are not accepted by git. ("only one config at a time", it says.  On the first, it indeed does not read the global config.  Anyway I have upgraded to Windows 10 and git 2.13.2, so the quesion is no more relevant for myself. Shall I just let it here?  
> **username_1**: Sounds strange it doesn't accept a level to show the configuration at all. Well, seems other are interested in this question bu no one has a solution. I, for my part, have no problem with internal root CA used to sign our MITM proxy certificate or our internal gitlab server, so I can't reproduce it.  
> **username_0**: but does your git version support those tags for levels?  

---

## 2 answers

### Answer by username_1 on 2017-11-17. Score: 2

Been hit by this just today after a fresh install so here's how I got over it:

From your logs (emphasis is mine):

> fatal: unable to access ... : **schannel**: next InitializeSecurityContext failed:

git is configured to use schannel (windows native implementation), but schannel use windows certs bundle and not a the cainfo bundle.

To switch to openssl to use a custom bundle file use this:

`git config --system http.sslbackend openssl`

And now git will honor the CA bundle passed in http.sslcainfo.

Alternatively as my error was a problem of cypher suite you may be interested by the following links:

* <https://support.microsoft.com/en-us/help/3161639>
* in case you have still an old system (Win2k3) <https://support.microsoft.com/en-us/help/948963/an-update-is-available-to-add-support-for-the-tls-rsa-with-aes-128-cbc>


---

### Answer by username_3 on 2017-08-31. Score: 1

I had something similar a year ago, so I hope I remember -

You should have all the certificate chain in the crt file. Verify that you have all the intermediate certificates between your bitbucket certificate and the root one (inclusive).

You can have a look at the correct format for appending them in the pem format (which I believe is your case with the crt) over [here](https://www.digicert.com/ssl-support/pem-ssl-creation.htm).

My certificate was signed by Comodo when I had that issue, their certificate and the intermediate weren't in the default ca-bundle supplied by most systems.

Hope that helps!

**Edit:** Now I noticed it happens also with the fake one - try to check the systems default known certificates (each system has such). On windows you can go to the [Windows Certificates mmc snap-in](https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-view-certificates-with-the-mmc-snap-in).


---

