62
C:\Users\casta>curl https://c5.ppy.sh
curl: (35) schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate.

I've made my own CA, and I made a certificate from this CA.

The problem is, when I tried to access website with this certificate, It works fine!

but If I tried with curl or C# applications, It returns error.

C# error is here:

2019-02-28T09:20:33: System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel
2019-02-28T09:20:33: 위치: #=zGFbxUFU_LnBci6wJmmCy1$E=.#=z0YcFrd6MZP1A()
2019-02-28T09:20:33: 위치: #=zuFHGCPNOLQmjQEcRmqQHLnQ=.#=z3NGNjJ0=()
LPOPYui
  • 799
  • 1
  • 9
  • 17
  • I got this issue while using PowerShell on a network with a self-signed certificate. Unsure how to tell PowerShell that the cert is fine, though. – jeffsdata Dec 09 '21 at 16:12

4 Answers4

143

I've been using curl through a mitm proxy for pen-testing and getting the same issue.

I finally figured that curl needs a parameter telling it not to check certificate revocation, so the command looks something like this:

curl "https://www.example.com" --ssl-no-revoke -x 127.0.0.1:8081

The -x parameter passes the proxy details - you may not need this.

General Grievance
  • 4,555
  • 31
  • 31
  • 45
riemannzz
  • 1,731
  • 1
  • 13
  • 8
  • 3
    Terrible solution though, because anyone can MITM you so theres very little point in using https. – dagelf Apr 13 '23 at 11:29
7

You can use the --ssl flag and omit the https like this

curl --ssl c5.ppy.sh
Max
  • 6,821
  • 3
  • 43
  • 59
  • 1
    How does `--ssl` flag helps here? Just curious. – Surya Mar 15 '21 at 10:12
  • 2
    It tries with ssl and if fails revert to non-secure [docs](https://curl.se/docs/manpage.html#--ssl). If you specify https you force curl to use ONLY the SSL. – Max Mar 15 '21 at 10:23
5

Don't panic... Please check your anti virus and turn off. It happened because your connection is blocked.

Kang Tri
  • 51
  • 1
  • 1
-1

You need to create a CRL list, and publish it to webserver.

LPOPYui
  • 799
  • 1
  • 9
  • 17