Invoke-WebRequest only works once in a PowerShell 5.1 Instance against Pode HTTP Server Instance

Viewed 191

I am using Invoke-WebRequest with a Client Certificate against a Pode HTTPS server instance (See this GitHub issue for its implementation, running on Windows Server 2019) in a Windows PowerShell 5.1.19041.1645 instance (.NET Framework 4.8.04084, running on Windows 10) running as Administrator but it will only work once successfully in that instance, all subsequent invocations/requests will result in a timeout:

$Certificate = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq 'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF' } # As Administrator
Invoke-WebRequest -Uri 'https://api.example.com/api/v1.0/test' -Certificate $Certificate -TimeoutSec 10

-however, if I run this in PowerShell 7.2.2 it will function correctly on the first and subsequent invocations.

Other things of note:

  • This also affects Invoke-RestMethod and System.Net.WebClient.
  • If I exclude the Client Certificate from the request, the behaviour still occurs regardless (Client Certificates are not required even when enabled, as per SslStream.AuthenticateAsServerAsync, so TLS should work with HTTP 401 returned, which it does for the first request)
  • No Web Proxies are utilised on the system.
  • No transparent proxies are used on the network. No DPI IPS is affecting TCP traffic. Behaviour occurs on a local PowerShell 5.1 instance on the server hosting the HTTPS service itself (Pode).
  • When I do specify a proxy, the problem goes away. The behaviour doesn't occur in PowerShell 5.1 when I specify a local mitmproxy instance via the Proxy parameter to Invoke-WebRequest.
  • Requests made to other web servers succeed on first and subsequent requests.
  • If I don't specify TimeoutSec it will just hang forever.
  • [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 does not change the behaviour.
  • SChannel configuration on client is standard, the SChannel server configuration supports TLS 1.0, TLS 1.1 and TLS 1.2 and associated ciphersuites.

I'm assuming this is due to some implementation difference between .NET Framework 4.8 and .NET 6.0 that's incompatible with this HTTPS server? It seems Pode has it's own HTTP Implementation (PodeHttpRequest.cs) and deals with TLS via use of SslStream (PodeRequest.cs) so maybe there is a Pode bug?

How do I fix or mitigate this? Is this issue on the client-side or server-side? My configuration or a bug?

0 Answers
Related