Answers: <p>Been hit by this just today after a fresh install so here's how I got over it:</p>
  
  <p>From your logs (emphasis is mine):</p>
  
  <blockquote>
    <p>fatal: unable to access ... : <strong>schannel</strong>: next InitializeSecurityContext failed:</p>
  </blockquote>
  
  <p>git is configured to use schannel (windows native implementation), but schannel use windows certs bundle and not a the cainfo bundle.</p>
  
  <p>To switch to openssl to use a custom bundle file use this:</p>
  
  <p><code>git config --system http.sslbackend openssl</code></p>
  
  <p>And now git will honor the CA bundle passed in http.sslcainfo.</p>
  
  <p>Alternatively as my error was a problem of cypher suite you may be interested by the following links:</p>
  
  <ul>
  <li><a href="https://support.microsoft.com/en-us/help/3161639" rel="nofollow noreferrer">https://support.microsoft.com/en-us/help/3161639</a></li>
  <li>in case you have still an old system (Win2k3) <a href="https://support.microsoft.com/en-us/help/948963/an-update-is-available-to-add-support-for-the-tls-rsa-with-aes-128-cbc" rel="nofollow noreferrer">https://support.microsoft.com/en-us/help/948963/an-update-is-available-to-add-support-for-the-tls-rsa-with-aes-128-cbc</a></li>
  </ul>
  
Answers: CC BY-SA 3.0
Answers: 2017-11-17T10:04:07.120Z
Answers: 2017-11-17T10:37:47.613Z
Answers: 2017-11-17T10:37:47.613Z
Answers: Tensibai
Answers: <p>I had something similar a year ago, so I hope I remember -</p>
  
  <p>You should have all the certificate chain in the crt file. Verify that you have all the intermediate certificates between your bitbucket certificate and the root one (inclusive).</p>
  
  <p>You can have a look at the correct format for appending them in the pem format (which I believe is your case with the crt) over <a href="https://www.digicert.com/ssl-support/pem-ssl-creation.htm" rel="nofollow noreferrer">here</a>.</p>
  
  <p>My certificate was signed by Comodo when I had that issue, their certificate and the intermediate weren't in the default ca-bundle supplied by most systems.</p>
  
  <p>Hope that helps!</p>
  
  <p><strong>Edit:</strong> Now I noticed it happens also with the fake one - try to check the systems default known certificates (each system has such). On windows you can go to the <a href="https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-view-certificates-with-the-mmc-snap-in" rel="nofollow noreferrer">Windows Certificates mmc snap-in</a>.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-31T21:44:25.253Z
Answers: 2017-08-31T21:49:28.057Z
Answers: 2017-08-31T21:49:28.057Z
Answers: arieljannai
Body: <p>all, I have a working certificates chain (testable with OpenSSL) but somehow I cannot manage to tell Git to load these certificates. </p>
  
  <p>I get <strong>the same</strong> "untrusted root authority" error (SEC_E_UNTRUSTED_ROOT) <strong>independently</strong> of whether my git configuration points to an existing or a fake certificate chain file.</p>
  
  <p>For details, please check the attached screenshot.<a href="https://i.sstatic.net/dB3ft.png" rel="noreferrer"><img src="https://i.sstatic.net/dB3ft.png" alt="enter image description here"></a></p>
  
  <p>Setting I use in <code>.gitconfig</code> for fake file:</p>
  
  <pre><code>sslCAInfo = C:/tmp/foobar.crt
  </code></pre>
  
  <p>or, for real file which works with OpenSSL:</p>
  
  <pre><code>sslCAInfo = C:/tmp/ca-bundle.crt
  </code></pre>
  
  <p>Console transcript:</p>
  
  <pre><code>C:\tmp&gt;openssl version
  OpenSSL 0.9.8h 28 May 2008
  
  C:\tmp&gt;git --version
  git version 2.12.2.windows.2
  
  C:\tmp&gt;git config --list
  http.sslverify=true
  http.sslcainfo=C:/tmp/ca-bundle.crt
  
  C:\tmp&gt;dir
  24.04.2017 13:45 10.875 ca-bundle.crt
  
  c:\tmp&gt;openssl s_client -state -connect https://mygithost:443 -CAfile .\ca-bundle.crt
  
  Verify return code: 0 (ok)
  
  C:\tmp git clone https://mygithost/bitbucket/scm/my.git
  Cloning into ...
  fatal: unable to access ... : schannel: next InitializeSecurityContext failed: SEC_E_UNTRUSTED_ROOT (0x80090325) - The certificate chain was issued by an authority that is not trusted.
  
  C:\tmp&gt; git -c http.sslverify=false clone https://mygithost/bitbucket/scm/my.git
  Cloning into ...
  Resoliving deltas: 100%, done.
  
  C:\tmp&gt;git config --list
  http.sslverify=true
  http.sslcainfo=C:/tmp/foobar.crt
  
  C:\tmp\xxx\git pull
  fatal: unable to access ... : schannel: next InitializeSecurityContext failed: SEC_E_UNTRUSTED_ROOT (0x80090325) - The certificate chain was issued by an authority that is not trusted.
  </code></pre>
  
Comments: CC BY-SA 3.0
Comments: 2017-04-27T07:09:13.943Z
Comments: You have a typo in your git configuration : tml instead of tmp
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-04-27T07:26:54.577Z
Comments: I find it strange git does not raise an error with fakepath.  You should verify other configuration levels (global,  user and repo) there's probably a fallback somewhere
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-04-27T08:50:08.273Z
Comments: @Tensibai please provide instructions or a link to docs, not sure how to print out all that. e.g. git config --global --list does not work.
Comments: Ta Mu
Comments: CC BY-SA 3.0
Comments: 2017-04-27T09:13:09.110Z
Comments: Git config --get-all should do to show every resulting configuration from system,  global and local (can't verify I'm on phone, and that's just a guess, workaround  could be `set SSL_CERT_FILE=C:\tmp\ca-bundle.crt` to tell openssl where to find the bundle
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-05-03T10:48:44.753Z
Comments: `C:\git config --get-all--          =>  error: wrong number of arguments`
Comments: Ta Mu
Comments: CC BY-SA 3.0
Comments: 2017-05-03T11:20:45.363Z
Comments: Get-all takes a regex,  try with .* as parameter
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-05-03T13:27:56.643Z
Comments: `error: key does not contain a section: .* `
Comments: Ta Mu
Comments: CC BY-SA 3.0
Comments: 2017-05-03T16:13:20.933Z
Comments: OK,  I'm sorry I don't have git on phone to get the proper command to copy paste.  I had hope you'll try a little harder by yourself...
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-06-08T12:56:22.767Z
Comments: Try `git config -l`, `git config -l --global`, `git config -l --system` and `got config -l --local` to see each level of configuration
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-06-13T16:50:32.497Z
Comments: Any update on this? Having the same problem.
Comments: derivation
Comments: CC BY-SA 3.0
Comments: 2017-07-10T15:35:35.217Z
Comments: @tensibai interestingly, only the first command works, the other are not accepted by git. ("only one config at a time", it says.  On the first, it indeed does not read the global config. 
  Anyway I have upgraded to Windows 10 and git 2.13.2, so the quesion is no more relevant for myself. Shall I just let it here?
Comments: Ta Mu
Comments: CC BY-SA 3.0
Comments: 2017-07-10T15:46:58.710Z
Comments: Sounds strange it doesn't accept a level to show the configuration at all. Well, seems other are interested in this question bu no one has a solution. I, for my part, have no problem with internal root CA used to sign our MITM proxy certificate or our internal gitlab server, so I can't reproduce it.
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-07-10T15:48:07.703Z
Comments: but does your git version support those tags for levels?
Comments: Ta Mu
Tags: <git><windows><ssl>
Title: Git seems to recognize http.sslcainfo property from .gitconfig but ignores it on execution? SEC_E_UNTRUSTED_ROOT
UserDisplayName: Ta Mu
ThreadText: # Git seems to recognize http.sslcainfo property from .gitconfig but ignores it on execution? SEC_E_UNTRUSTED_ROOT
  
  (Asked by: username_0 on 2017-04-26)
  
  all, I have a working certificates chain (testable with OpenSSL) but somehow I cannot manage to tell Git to load these certificates.
  
  I get **the same** "untrusted root authority" error (SEC\_E\_UNTRUSTED\_ROOT) **independently** of whether my git configuration points to an existing or a fake certificate chain file.
  
  For details, please check the attached screenshot.[![enter image description here](https://i.sstatic.net/dB3ft.png)](https://i.sstatic.net/dB3ft.png)
  
  Setting I use in `.gitconfig` for fake file:
  
  ```
  sslCAInfo = C:/tmp/foobar.crt
  
  ```
  
  or, for real file which works with OpenSSL:
  
  ```
  sslCAInfo = C:/tmp/ca-bundle.crt
  
  ```
  
  Console transcript:
  
  ```
  C:\tmp>openssl version
  OpenSSL 0.9.8h 28 May 2008
  
  C:\tmp>git --version
  git version 2.12.2.windows.2
  
  C:\tmp>git config --list
  http.sslverify=true
  http.sslcainfo=C:/tmp/ca-bundle.crt
  
  C:\tmp>dir
  24.04.2017 13:45 10.875 ca-bundle.crt
  
  c:\tmp>openssl s_client -state -connect https://mygithost:443 -CAfile .\ca-bundle.crt
  
  Verify return code: 0 (ok)
  
  C:\tmp git clone https://mygithost/bitbucket/scm/my.git
  Cloning into ...
  fatal: unable to access ... : schannel: next InitializeSecurityContext failed: SEC_E_UNTRUSTED_ROOT (0x80090325) - The certificate chain was issued by an authority that is not trusted.
  
  C:\tmp> git -c http.sslverify=false clone https://mygithost/bitbucket/scm/my.git
  Cloning into ...
  Resoliving deltas: 100%, done.
  
  C:\tmp>git config --list
  http.sslverify=true
  http.sslcainfo=C:/tmp/foobar.crt
  
  C:\tmp\xxx\git pull
  fatal: unable to access ... : schannel: next InitializeSecurityContext failed: SEC_E_UNTRUSTED_ROOT (0x80090325) - The certificate chain was issued by an authority that is not trusted.
  
  ```
  
  **Tags:** git, windows, ssl
  
  > **Comments:**
  > **username_1**: You have a typo in your git configuration : tml instead of tmp  
  > **username_1**: I find it strange git does not raise an error with fakepath.  You should verify other configuration levels (global,  user and repo) there's probably a fallback somewhere  
  > **username_0**: @username_1 please provide instructions or a link to docs, not sure how to print out all that. e.g. git config --global --list does not work.  
  > **username_1**: Git config --get-all should do to show every resulting configuration from system,  global and local (can't verify I'm on phone, and that's just a guess, workaround  could be `set SSL_CERT_FILE=C:\tmp\ca-bundle.crt` to tell openssl where to find the bundle  
  > **username_0**: `C:\git config --get-all--          =>  error: wrong number of arguments`  
  > **username_1**: Get-all takes a regex,  try with .* as parameter  
  > **username_0**: `error: key does not contain a section: .* `  
  > **username_1**: OK,  I'm sorry I don't have git on phone to get the proper command to copy paste.  I had hope you'll try a little harder by yourself...  
  > **username_1**: Try `git config -l`, `git config -l --global`, `git config -l --system` and `got config -l --local` to see each level of configuration  
  > **username_2**: Any update on this? Having the same problem.  
  > **username_0**: @username_1 interestingly, only the first command works, the other are not accepted by git. ("only one config at a time", it says.  On the first, it indeed does not read the global config.  Anyway I have upgraded to Windows 10 and git 2.13.2, so the quesion is no more relevant for myself. Shall I just let it here?  
  > **username_1**: Sounds strange it doesn't accept a level to show the configuration at all. Well, seems other are interested in this question bu no one has a solution. I, for my part, have no problem with internal root CA used to sign our MITM proxy certificate or our internal gitlab server, so I can't reproduce it.  
  > **username_0**: but does your git version support those tags for levels?  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2017-11-17. Score: 2
  
  Been hit by this just today after a fresh install so here's how I got over it:
  
  From your logs (emphasis is mine):
  
  > fatal: unable to access ... : **schannel**: next InitializeSecurityContext failed:
  
  git is configured to use schannel (windows native implementation), but schannel use windows certs bundle and not a the cainfo bundle.
  
  To switch to openssl to use a custom bundle file use this:
  
  `git config --system http.sslbackend openssl`
  
  And now git will honor the CA bundle passed in http.sslcainfo.
  
  Alternatively as my error was a problem of cypher suite you may be interested by the following links:
  
  * <https://support.microsoft.com/en-us/help/3161639>
  * in case you have still an old system (Win2k3) <https://support.microsoft.com/en-us/help/948963/an-update-is-available-to-add-support-for-the-tls-rsa-with-aes-128-cbc>
  
  
  ---
  
  ### Answer by username_3 on 2017-08-31. Score: 1
  
  I had something similar a year ago, so I hope I remember -
  
  You should have all the certificate chain in the crt file. Verify that you have all the intermediate certificates between your bitbucket certificate and the root one (inclusive).
  
  You can have a look at the correct format for appending them in the pem format (which I believe is your case with the crt) over [here](https://www.digicert.com/ssl-support/pem-ssl-creation.htm).
  
  My certificate was signed by Comodo when I had that issue, their certificate and the intermediate weren't in the default ca-bundle supplied by most systems.
  
  Hope that helps!
  
  **Edit:** Now I noticed it happens also with the fake one - try to check the systems default known certificates (each system has such). On windows you can go to the [Windows Certificates mmc snap-in](https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-view-certificates-with-the-mmc-snap-in).
  
  
  ---
  
  