Default SecurityProtocol in PowerShell 5.1

Viewed 1077

I am having a problem with a script running on a Windows 2016 Standard server with PowerShell 5.1, that is failing due to the default SecurityProtocol when making web requests using a HttpClient:

The request was aborted: Could not create SSL/TLS secure channel.

I have spent a large amount of time researching this and I understand why it happens and the various options available to force a more secure protocol. However, I am completely stuck on why I am seeing different defaults between the problem server and my Windows 10 workstation, which are both running PowerShell 5.1.

On the server (Windows 2016 Standard), where the script is failing:

I see this for the default SecurityProtocol, specific weak protocols:

PS > [Net.ServicePointManager]::SecurityProtocol
Ssl3, Tls

$PsVersionTable returns this:

Name                           Value
----                           -----
PSVersion                      5.1.14393.3866
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14393.3866
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

On my workstation (Windows 10 2004), where the script works:

A SecurityProtocol of SystemDefault:

PS > [Net.ServicePointManager]::SecurityProtocol
SystemDefault

and for $PsVersionTable:

Name                           Value
----                           -----
PSVersion                      5.1.19041.546
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.19041.546
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

As you can see the two return different SecurityProtocol defaults but they only appear to differ by a minor PS version; 5.1.14393.3866 vs 5.1.19041.546.

Both the server and workstation have a fairly vanilla set-up. None of the registry changes that are recommended to default to more secure protocols have been made to either box; i.e. SchUseStrongCrypto, properties under HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols, etc. Both servers have up to and including .NET Framework 4.8 installed.

I really don't know where else to look as I'd be surprised if a difference in a minor PS version would bring about this change. Have I missed something (Windows security updates?) or am I not understanding how the SecurityProtocol defaulting works?

0 Answers
Related