winhttp 访问https_不理解为什么WinHTTP不能验证某些HTTPS资源

I'd be extremely grateful for any kind of help that may help me resolving the problem.

From Excel VBA code I need to download & parse CSV file from HTTPS site https://redmine.itransition.com/. I try to use WinHTTP to get the file. However, I can't understand why authentication does not work. Here is the piece of related code:

TargetURL = "https://redmine.itransition.com/projects/pmct/time_entries.csv"

Set HTTPReq = CreateObject("WinHttp.WinHttpRequest.5.1")

HTTPReq.Option(4) = 13056 ' WinHttpRequestOption_SslErrorIgnoreFlags 13056: ignore all err, 0: accept no err

HTTPReq.Open "GET", TargetURL, False

HTTPReq.SetCredentials "UN", "PW", 0

HTTPReq.send

returns the following response (only certain strings are listed):

Content-Type: text/html; charset=utf-8

Status: 406

X-Runtime: 5

However, if I send "Cookie" string from Firefox cookie after successful manual authentication using

HTTPReq.setRequestHeader "Cookie", SetCookieString

HTTPReq.send

I easily get the expected file. Of course I'm not happy with such solution, and want to perform true WinHTTP authentication. However, I can't understand what's wrong or what I miss in my code. Most likely I have to use .SetClientCertificate method, but this is unclear for me - which cert is required?

Or, being more general: which WinHTTP methods or functions I should use for debugging to find out which step is blocking / incorrect and prevents me from correct authentication? I spent 2 weeks seeking through MSDN and various resources, but still have no solution.

Thanks in advance for your suggestions!

解决方案

The logon at https://redmine.itransition.com/ is just an HTML form that posts a username & password to a script at /login.

This is not compatible with SetCredentials which is designed for server based authentication schemes like basic/digest/ntlm.

You need to load that page with no credentials, grab what looks like the volatile field authenticity_token from the generated form & post that along with username & password to /login.

If its a session based system it will response with the set-cookie header + data you need to use in subsequent request.