We have users that use company wide man-in-the-middle proxies for internal security. However client software with libCURL + WinSSL reports following error in their environments:

schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate.

All other Windows software work fine. It is also reproducable with Fiddler acting as decrypting proxy - as discussed in this issue #264

While solution was implemented:
curl_easy_setopt(m_curl, CURLOPT_SSL_OPTIONS, CURLSSLOPT_NO_REVOKE);

I would argue that this is not enough, especially as it makes CURL + WinSSL software act different from other Windows based software and reduces security.

I did this

Tested with build: https://curl.haxx.se/windows/

1. Run Fiddler
2. set CURL_SSL_BACKEND=Schannel
3. curl https://google.com -x 127.0.0.1:8888
   (Got 0x80092012 error)
4. curl https://google.com -x 127.0.0.1:8888 --ssl-no-revoke
   (Succeeded as expected)
5. curl https://revoked.badssl.com/ --ssl-no-revoke
   (Succeeded, but there should be option to not allow this)

Also tested with custom proxy server instead of Fiddler

1. Self signed Root CA certificate
   OpenSSL can be used to generate it.
   Easy-RSA utility simplifies that process, more documentation can be found here:
   https://github.com/OpenVPN/easy-rsa/blob/master/README.quickstart.md
   CA certificate should have revocation list configured
2. Burp configured as a proxy with previously generated certificate imported.
3. On client machine Root CA certificate has to be installed into Trusted Root Authorities store.
4. curl https://google.com -x ProxyServerUrl:ProxyPort
   (Got 0x80092012 error)

curl version

curl 7.64.0 (x86_64-pc-win32) libcurl/7.64.0 (OpenSSL/1.1.1a) Schannel zlib/1.2.11 brotli/1.0.7 WinIDN libssh2/1.8.0 nghttp2/1.36.0
Release-Date: 2019-02-06
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz brotli TLS-SRP HTTP2 MultiSSL

operating system

Microsoft Windows [Version 10.0.17134.648]