Скачать или смотреть Resolving the Powershell Authentication Issue with TLS 1.2

Discover how to resolve `Powershell` authentication failures when using TLS 1.2. Learn the steps and solutions to ensure a secure connection.
---
This video is based on the question https://stackoverflow.com/q/71151782/ asked by the user 'Code39' ( https://stackoverflow.com/u/3033906/ ) and on the answer https://stackoverflow.com/a/71151783/ provided by the user 'Code39' ( https://stackoverflow.com/u/3033906/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Powershell failing during call to AuthenticateAsClient when only TLS 1.2 available on server

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Resolving the Powershell Authentication Issue with TLS 1.2: A Comprehensive Guide

When working with secure connections in Powershell, many developers have encountered an issue that arises when only TLS 1.2 is available on the server. You may see error messages like:

"Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host."

"A call to SSPI failed, see inner exception."

These errors can be frustrating and can thwart your endeavors while trying to create secure socket connections. The good news is that there is a solution to this problem. In this guide, we will explore the issue and present a structured solution to help you successfully authenticate using TLS 1.2.

Understanding the Problem

The issue arises when authenticating using an SSL stream in Powershell on a server configured to use only TLS 1.2. The default configuration may cause the AuthenticateAsClient call to fail when TLS versions earlier than 1.2 (like TLS 1.0) are disabled.

Common Symptoms

Connection errors indicating that the server rejected the connection.

Various error messages that do not provide clear guidance on how to resolve the issue.

Inconsistent performance across different server versions.

To replicate the issue, you can use the following minimal Powershell code snippet:

[[See Video to Reveal this Text or Code Snippet]]

Default Protocol Configuration

Previously, it was a common solution to set the available protocols like this:

[[See Video to Reveal this Text or Code Snippet]]

However, this method has limitations, especially when the server has TLS 1.0 disabled. Setting the protocols this way often doesn't influence the behavior of the AuthenticateAsClient method effectively.

A Practical Solution

After extensive trials, the issue seems to stem from a bug in Powershell that may overlook the globally set TLS protocol values. To navigate around this, you can modify your AuthenticateAsClient method call directly to specify the TLS versions as follows:

[[See Video to Reveal this Text or Code Snippet]]

Breakdown of the Solution

Specify Protocols Directly: Instead of relying on global settings, explicitly list the TLS protocols needed.

Negotiate the Highest Version: This change allows the method to properly negotiate the highest available version of TLS.

Test the Connection: After attempting the connection, you can confirm that it successfully uses the TLS version intended.

Conclusion

While the errors encountered during the authentication process in Powershell can be daunting, understanding the underlying problem and addressing it with a tailored solution can save you hours of troubleshooting. By directly specifying the TLS versions required during the AuthenticateAsClient call, you can ensure a successful, secure connection.

If you're experiencing similar issues, give this solution a try and see how it can enhance your Powershell scripting experience!