Powershell 4 too old for tls 1.2?

Question

I have a Windows Server 2012R2 with powershell 4.

A sql job issues a Invoke-WebRequest https://someserver/file.xml -OutFile c:/tmp/data.xml"

It fails with ssl error, even if I follow Powershell Invoke-WebRequest Fails with SSL/TLS Secure Channel and prepend [Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls" or the other variations.

Is powershell 4 too old?

Should I try installing Wowershell 6 or 7 from https://github.com/PowerShell/PowerShell/releases ?

Will that be invoked by the sqljob, or should it be specified somewhere/somehow that it's supposed to run v7 instead of v4?

PS: I know "Windows Server 2012 R2 entered mainstream support on November 25, 2013, though, but its end of mainstream is January 9, 2018, and end of extended is January 10, 2023" but upgrading is not an option right now.

EDIT

I installed powershell 5.1, it didn't change


Major  Minor  Build  Revision
-----  -----  -----  --------
5      1      14409  1005

and do

[Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"

But still get Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure channel.

EDIT 2

PS C:\Users\leif> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.14409.1005
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14409.1005
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

user_4584274 · Answer

I believe it is. Powershell relies upon the .Net framework under the hood. PS version 4 uses .Net 4.0 which I believe did not have support for TLS 1.2 added or enabled by default.

See: https://docs.microsoft.com/en-us/powershell/scripting/install/windows-powershell-system-requirements?view=powershell-7

TLS 1.2 was made the default protocol in .Net 4.6 See: https://blogs.perficient.com/2016/04/28/tsl-1-2-and-net-support/

Make note of: NET 4.0. TLS 1.2 is not supported

So you're going to need to code around it as others have suggested or upgraded to WMF 5.1. Before completing the upgrade be sure to make sure it will not break anything. Some MS products, like SharePoint, may not be compatible with the newer version.

Also, try setting your TLS via:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

The above assumes a PowerShell version with support.

Powershell 4 too old for tls 1.2?

1 Answers