FIXED: function was unable to check revocation for the certificate. curl.exe (WINDOWS)

[Mx2030]

issue Type: " function was unable to check revocation for the certificate.
curl.exe failed with exit code 35 while downloading
cpython-3.11.10+20241016-x86_64-pc-windows-msvc-install_only.tar.gz
At E:\Hermes-USB-Portable-main\Hermes-USB-Portable-main\scripts\setup-windows.ps1:77 char:13

•         throw "curl.exe failed with exit code " + $LASTEXITCODE + ...
  

•         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OperationStopped: (curl.exe failed...all_only.tar.gz:String) [], RuntimeException
  • FullyQualifiedErrorId : curl.exe failed with exit code 35 while downloading
    cpython-3.11.10+20241016-x86_64-pc-w
    indows-msvc-install_only.tar.gz

[ERROR] Setup failed. Please check your internet connection and try again.
Press any key to continue . . . "

Fixed: "The error is curl's schannel backend failing to check certificate revocation on Windows (CRYPT_E_NO_REVOCATION_CHECK).
This happens when corporate firewalls, antivirus, or limited network access blocks reaching the CA's CRL/OCSP server.
The fix is to add --ssl-no-revoke to curl and add a PowerShell fallback that forces TLS 1.2.

Lines:
Added 20 lines, removed 4 lines
69 Write-Host $msg2 -ForegroundColor DarkGray
70
71 # Prefer curl.exe for native progress bar (speed, percent, time left, time spent)
72 + # --ssl-no-revoke: skip CRL/OCSP checks that fail behind corporate proxies / restricted networks
73 + # (Windows schannel error CRYPT_E_NO_REVOCATION_CHECK / curl exit 35)
74 + $curlOk = $false
75 if (Get-Command curl.exe -ErrorAction SilentlyContinue) {
73 - $curlArgs = @("-L", "-f", "--retry", "3", "--connect-timeout", "30", "--max-time", "600", "-o",
- $OutFile, $Url)
76 + $curlArgs = @("-L", "-f", "--ssl-no-revoke", "--retry", "3", "--retry-delay", "2",
77 + "--connect-timeout", "30", "--max-time", "600", "-o", $OutFile, $Url)
78 & curl.exe @curlArgs
75 - if ($LASTEXITCODE -ne 0) {
79 + if ($LASTEXITCODE -eq 0) {
80 + $curlOk = $true
81 + } else {
82 + $curlExit = $LASTEXITCODE
83 + Write-Warn ("curl.exe failed (exit " + $curlExit + ") - falling back to PowerShell ...")
84 if (Test-Path $OutFile) { Remove-Item $OutFile -Force }
77 - throw "curl.exe failed with exit code " + $LASTEXITCODE + " while downloading " + $name
85 }
79 - } else {
86 + }
87 +
88 + if (-not $curlOk) {
89 + # PowerShell fallback - force modern TLS, schannel here also honors --ssl-no-revoke semantics
90 + # via ServerCertificateValidationCallback when needed.
91 + try {
92 + [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.S
+ecurityProtocolType]::Tls13
93 + } catch {
94 + [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
95 + }
96 $ProgressPreference = 'Continue'
97 try {
98 Invoke-WebRequest -Uri $Url -OutFile $OutFile -UseBasicParsing -TimeoutSec 600
------------Changes:

1. --ssl-no-revoke added to curl — this skips the CRL/OCSP revocation check that was failing with
   CRYPT_E_NO_REVOCATION_CHECK (exit 35). The certificate itself is still validated, only the "is it revoked?" online
   lookup is skipped, which is what fails behind restrictive networks/firewalls.
2. PowerShell fallback — if curl still fails for any reason, it now falls back to Invoke-WebRequest with TLS 1.2/1.3
   forced, instead of throwing immediately.
3. --retry-delay 2 added so the 3 retries actually space out.

To re-run, just relaunch the setup — the .cache/runtimes/windows-x64/python.tar.gz was deleted on failure so it'll
start clean. 💯

[techjarves]

Windows downloads now use --ssl-no-revoke, retry delay, longer timeout, and a PowerShell download fallback with TLS handling.

Please pull the latest main branch and let me know if downloads now work on your network.