Problem with Set-AzureDeployment -Upgrade / Could not create SSL/TLS secure channel

I have a problem with Set-AzureDeployment -Upgrade, when I added remote access configuration to cloud service.

I want to enable RDP on cloud service automatically during deployment, so I added only to ServiceDefinition.csdef

<Imports>
    <Import moduleName="RemoteAccess" />
    <Import moduleName="RemoteForwarder" />
</Imports>

and to ServiceConfiguration.cscfg

<ConfigurationSettings>
    <Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.Enabled" value="true" />
    <Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountUsername" value="[name-of-user-account]" />
    <Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountEncryptedPassword" value="[base-64-encrypted-user-password]" />
    <Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountExpiration" value="[certificate-expiration-date]" />
    <Setting name="Microsoft.WindowsAzure.Plugins.RemoteForwarder.Enabled" value="true" />
</ConfigurationSettings>

but no sense for me because:

• I added this configuration to other cloud services and it works fine, even if I use Set-AzureDeployment -Upgrade or New-AzureDeployment
• With one cloud service I have a problem only if I want to upgrade it. When I remove deployment and use New-AzureDeployment works.
• I noticed if I don't upload the package to Azure Storage first (using Set-AzureStorageBlobContent) but use Uri from package uploaded previously and upgrade, works. The problem occurs when I do some other things before upgrading, like uploading package.

Any idea, what can I check else ? I've tried to force TLS1.0, TLS1.1 and TLS1.2 on start script. I thought it was a problem, because script is run from Octopus, but I run it from PowerShell console and the same.

And still I have

Set-AzureDeployment : An error occurred while sending the request.
At C:\Users\*****\Downloads\installTest.ps1:111 char:2
+     Set-AzureDeployment -Upgrade -ServiceName $OctopusAzureServiceNam ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Set-AzureDeployment], HttpRequestException
    + FullyQualifiedErrorId : Microsoft.WindowsAzure.Commands.ServiceManagement.HostedServices.SetAzureDeploymentCommand

DEBUG: AzureQoSEvent: CommandName - Set-AzureDeployment; IsSuccess - False; Duration - 00:02:03.3858597; Exception -
System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The request
was aborted: Could not create SSL/TLS secure channel.
   at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
   at System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)
   --- End of inner exception stack trace ---
   at Microsoft.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at Microsoft.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccess(Task task)
   at Microsoft.WindowsAzure.Management.Compute.DeploymentOperationsExtensions.UpgradeBySlot(IDeploymentOperations operations,  String serviceName, DeploymentSlot deploymentSlot, DeploymentUpgradeParameters parameters)
   at Microsoft.WindowsAzure.Commands.Utilities.Common.ServiceManagementBaseCmdlet.ExecuteClientActionNewSM[TResult](Object
input, String operationDescription, Func`1 action, Func`3 contextFactory);
DEBUG: Finish sending metric.
DEBUG: 12:09:19 - SetAzureDeploymentCommand end processing.
DEBUG: 12:09:19 - SetAzureDeploymentCommand end processing.