Git-credential-manager-for-windows: Authentication to GitHub broken "fatal: HttpRequestException encountered" / "Could not create SSL/TLS secure channel"

[letmaik]

I suddenly get the below error when I want to push to GitHub. It also suddenly opens the 2FA prompt even though I didn't logout or similar.

19:59:35.845421 git.c:344               trace: built-in: git 'push'
19:59:35.856423 run-command.c:626       trace: run_command: 'remote-https' 'origin' 'https://github.com/...git'
19:59:35.905423 git.c:576               trace: exec: 'git-remote-https' 'origin' 'https://github.com/....git'
19:59:35.905937 run-command.c:626       trace: run_command: 'git-remote-https' 'origin' 'https://github.com/....git'
* Couldn't find host github.com in the _netrc file; using defaults
*   Trying 192.30.253.113...
* TCP_NODELAY set
* Connected to github.com (192.30.253.113) port 443 (#0)
* schannel: SSL/TLS connection with github.com port 443 (step 1/3)
* schannel: checking server certificate revocation
* schannel: sending initial handshake data: sending 175 bytes...
* schannel: sent initial handshake data: sent 175 bytes
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: failed to receive handshake, need more data
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: encrypted data got 1436
* schannel: encrypted data buffer: offset 1436 length 4096
* schannel: encrypted data length: 1334
* schannel: encrypted data buffer: offset 1334 length 4096
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: encrypted data got 1436
* schannel: encrypted data buffer: offset 2770 length 4096
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: encrypted data got 722
* schannel: encrypted data buffer: offset 3492 length 4096
* schannel: sending next handshake data: sending 126 bytes...
* schannel: SSL/TLS connection with github.com port 443 (step 2/3)
* schannel: encrypted data got 51
* schannel: encrypted data buffer: offset 51 length 4096
* schannel: SSL/TLS handshake complete
* schannel: SSL/TLS connection with github.com port 443 (step 3/3)
* schannel: stored credential handle in session cache
> GET /....git/info/refs?service=git-receive-pack HTTP/1.1
Host: github.com
User-Agent: git/2.15.0.windows.1
Accept: */*
Accept-Encoding: gzip
Pragma: no-cache

* schannel: client wants to read 16384 bytes
* schannel: encdata_buffer resized 17408
* schannel: encrypted data buffer: offset 0 length 17408
* schannel: encrypted data got 319
* schannel: encrypted data buffer: offset 319 length 17408
* schannel: decrypted data length: 290
* schannel: decrypted data added: 290
* schannel: decrypted data cached: offset 290 length 16384
* schannel: encrypted data buffer: offset 0 length 17408
* schannel: decrypted data buffer: offset 290 length 16384
* schannel: schannel_recv cleanup
* schannel: decrypted data returned 290
* schannel: decrypted data buffer: offset 0 length 16384
< HTTP/1.1 401 Authorization Required
< Server: GitHub Babel 2.0
< Content-Type: text/plain
< Content-Length: 63
< WWW-Authenticate: Basic realm="GitHub"
< X-GitHub-Request-Id: 092D:25C6:4010A:7747C:5A8F2128
< X-Frame-Options: DENY
<
* Connection #0 to host github.com left intact
19:59:36.547032 run-command.c:626       trace: run_command: 'git credential-manager get'
19:59:36.719945 git.c:576               trace: exec: 'git-credential-manager' 'get'
19:59:36.720444 run-command.c:626       trace: run_command: 'git-credential-manager' 'get'
19:59:36.890444 ...\Common.cs:524       trace: [Main] git-credential-manager (v1.12.0) 'get'
19:59:36.974945 ...\Where.cs:239        trace: [FindGitInstallations] found 1 Git installation(s).
19:59:36.981444 ...Configuration.cs:405 trace: [LoadGitConfiguration] git All config read, 34 entries.
19:59:36.982946 ...\Where.cs:239        trace: [FindGitInstallations] found 1 Git installation(s).
19:59:36.984947 ...Configuration.cs:405 trace: [LoadGitConfiguration] git All config read, 34 entries.
19:59:37.026447 ...\Common.cs:74        trace: [CreateAuthentication] detecting authority type for 'https://github.com/'.
19:59:37.041946 ...uthentication.cs:134 trace: [GetAuthentication] created GitHub authentication for 'https://github.com/'.
19:59:37.042456 ...\Common.cs:139       trace: [CreateAuthentication] authority for 'https://github.com/' is GitHub.
19:59:37.198858 ...icationPrompts.cs:46 trace: [CredentialModalPrompt] prompting user for credentials for 'https://github.com/'.
19:59:44.562674 ...\Program.cs:422      trace: [Run] System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.
   at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context)
   at System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar)
   --- End of inner exception stack trace ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at GitHub.Authentication.Authority.<AcquireToken>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at GitHub.Authentication.Authentication.<InteractiveLogon>d__25.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Alm.Cli.CommonFunctions.<>c__DisplayClass9_4.<<QueryCredentials>b__4>d.MoveNext()
19:59:44.572998 ...\Common.cs:492       trace: [LogEvent] System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.
   at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context)
   at System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar)
   --- End of inner exception stack trace ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at GitHub.Authentication.Authority.<AcquireToken>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at GitHub.Authentication.Authentication.<InteractiveLogon>d__25.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Alm.Cli.CommonFunctions.<>c__DisplayClass9_4.<<QueryCredentials>b__4>d.MoveNext()
19:59:44.594497 ...\Program.cs:422      trace: [Run] fatal: HttpRequestException encountered.
   An error occurred while sending the request.
fatal: HttpRequestException encountered.
   An error occurred while sending the request.

After that it prompts me for username/password which obviously doesn't work as I use 2FA.

I used the following to produce that output:

set GIT_TRACE=2
set GIT_CURL_VERBOSE=2
set GCM_TRACE=1
git push

git version: 2.15.0.windows.1
Windows 10 1709

[letmaik]

This seems to coincide with the removal of TLSv1/TLSv1.1 support: https://githubengineering.com/crypto-removal-notice/
Updating git to 2.16.2.windows.1 solved the issue.
It would be really good if the error messages could be improved without having to enable all kinds of trace logging and then guessing what it could be.

[augustoproiete]

Same issue here. I confirm updating to the latest version of Git (2.16.2.windows.1) fixes it.

[giorgosart]

Same here, updating the Git version fixed the issue for me as well 👍

[whoisj]

@letmaik @caioproiete @giorgosart correct, the issue is that GitHub rolled out TLS 1.2 as a requirement today. The GCM was updated to meet the requirement as of v1.14.0 (Git for Windows v2.16.2 or better).

[Dream4ever]

Thank you @letmaik , solved this problem by updating Git to the latest version.

[aseem01]

Thanks everyone for save my lot of time.Solved this problem only updating git version Git-2.13.0-32-bit to Git-2.16.2-32-bit.