Building PowerShell in Windows results in a mismatch in security certificates

Description

This issue is caused by a mismatch in TLS certification. Windows Powershell ships with version 1 of TLS, while Github requires version 1.2.

Steps to reproduce

When building PowerShell, run the Start-PSBootstrap script

PS C:> Start-PSBootstrap
Installing PowerShell build dependencies
dotnet is already installed.  Skipping installation.
pwsh.exe not found. Install latest PowerShell Core release and add it to Path
VERBOSE: Destination: C:\Users\joelj\AppData\Local\Microsoft\powershell
VERBOSE: About to download package from
'https://github.com/PowerShell/PowerShell/releases/download/v6.0.1/PowerShell-6.0.1-win-x64.zip'
Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure channel.
At D:\HackIllinois2018\Powershell\PowerShell\tools\install-powershell.ps1:139 char:9
+         Invoke-WebRequest -Uri $downloadURL -OutFile $packagePath
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc
   eption
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

Expected behavior

Script is able to establish a secure channel that matches default Windows certificates

Actual behavior

Error is returned: The request was aborted: could not create SSL/TLS secure channel.

Environment data

> $PSVersionTable
Name                           Value
----                           -----
PSVersion                      5.1.16299.248
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.16299.248
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Our first issue filled as part of Hackillinois2018! 🎉

workaround:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Mark Kraus (@markekraus)

In Powershell Core we already have Invoke-WebRequest -SslProtocol Tls12. I don't remember - maybe it is default. /cc Mark Kraus (@markekraus)
I don't see the problem if pwsh was installed - we require install pwsh to build.
So I believe we can close the Issue.

I don't see the problem if pwsh was installed - we require install pwsh to build.

it should work on windows powershell - this is what used for bootstrapping. There is no requirement to have pwsh for bootstrapping. Fix is on the way.

bad workaround, rushed PR. Please don't do this kind of thing.

[Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls11

Better workaround, but still rubs me the wrong way.

Navigation Menu

Repository navigation

Building PowerShell in Windows results in a mismatch in security certificates #6233

Description

Steps to reproduce

Expected behavior

Actual behavior

Environment data

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Building PowerShell in Windows results in a mismatch in security certificates #6233

Description

Description

Steps to reproduce

Expected behavior

Actual behavior

Environment data

Activity

vors commented on Feb 24, 2018

vors commented on Feb 24, 2018

iSazonov commented on Feb 24, 2018

vors commented on Feb 24, 2018

markekraus commented on Feb 24, 2018

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions