Similar to #3280
Negotiate authentication fails consistently on Windows when targeting https endpoint that is WIA protected. This only happens when "Extended Protection" is set to Accept or Require in the IIS server (Accept is the default). The same endpoint works when plain for HTTP.
You are using curl built to support multiple SSL backends OpenSSL and WinSSL. You'll notice WinSSL is in parentheses which means it's not being used. What happens when you set the backend to schannel (which is what WinSSL is formally known as)?
@jay I definitely use WinSSL. I am also running the same test from Visual Studio building with WinSSL and SSPI. Recently I put a PR for the same issue on NTLM #3321. The actual problem is that WinSSL binds the outer ssl connection to the NTLM and Negotiate messages to avoid replay attacks. Because WinSSL offers the bindings and the Windows servers accept them if they are offered, our requests are getting 401.
The fix is simple and I think similar to #3321, but applying similar changes can affect the non SSPI negotiate code.
I can work on it and sumbit a new PR, but it feels a bit out of my comfort zone. I am happy to do it, but I'd appreciate some help.