I am having a problem with a script running on a Windows 2016 Standard server with PowerShell 5.1, that is failing due to the default SecurityProtocol when making web requests using a HttpClient:
The request was aborted: Could not create SSL/TLS secure channel.
I have spent a large amount of time researching this and I understand why it happens and the various options available to force a more secure protocol. However, I am completely stuck on why I am seeing different defaults between the problem server and my Windows 10 workstation, which are both running PowerShell 5.1.
On the server (Windows 2016 Standard), where the script is failing:
I see this for the default SecurityProtocol, specific weak protocols:
PS > [Net.ServicePointManager]::SecurityProtocol
Ssl3, Tls
$PsVersionTable returns this:
Name Value
---- -----
PSVersion 5.1.14393.3866
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.3866
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
On my workstation (Windows 10 2004), where the script works:
A SecurityProtocol of SystemDefault:
PS > [Net.ServicePointManager]::SecurityProtocol
SystemDefault
and for $PsVersionTable:
Name Value
---- -----
PSVersion 5.1.19041.546
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.19041.546
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
As you can see the two return different SecurityProtocol defaults but they only appear to differ by a minor PS version; 5.1.14393.3866 vs 5.1.19041.546.
Both the server and workstation have a fairly vanilla set-up. None of the registry changes that are recommended to default to more secure protocols have been made to either box; i.e. SchUseStrongCrypto, properties under HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols, etc. Both servers have up to and including .NET Framework 4.8 installed.
I really don't know where else to look as I'd be surprised if a difference in a minor PS version would bring about this change. Have I missed something (Windows security updates?) or am I not understanding how the SecurityProtocol defaulting works?