I am using Invoke-WebRequest with a Client Certificate against a Pode HTTPS server instance (See this GitHub issue for its implementation, running on Windows Server 2019) in a Windows PowerShell 5.1.19041.1645 instance (.NET Framework 4.8.04084, running on Windows 10) running as Administrator but it will only work once successfully in that instance, all subsequent invocations/requests will result in a timeout:
$Certificate = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq 'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF' } # As Administrator
Invoke-WebRequest -Uri 'https://api.example.com/api/v1.0/test' -Certificate $Certificate -TimeoutSec 10
-however, if I run this in PowerShell 7.2.2 it will function correctly on the first and subsequent invocations.
Other things of note:
- This also affects
Invoke-RestMethodandSystem.Net.WebClient. - If I exclude the Client Certificate from the request, the behaviour still occurs regardless (Client Certificates are not required even when enabled, as per SslStream.AuthenticateAsServerAsync, so TLS should work with HTTP 401 returned, which it does for the first request)
- No Web Proxies are utilised on the system.
- No transparent proxies are used on the network. No DPI IPS is affecting TCP traffic. Behaviour occurs on a local PowerShell 5.1 instance on the server hosting the HTTPS service itself (Pode).
- When I do specify a proxy, the problem goes away. The behaviour doesn't occur in PowerShell 5.1 when I specify a local mitmproxy instance via the
Proxyparameter toInvoke-WebRequest. - Requests made to other web servers succeed on first and subsequent requests.
- If I don't specify
TimeoutSecit will just hang forever. [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12does not change the behaviour.- SChannel configuration on client is standard, the SChannel server configuration supports TLS 1.0, TLS 1.1 and TLS 1.2 and associated ciphersuites.
I'm assuming this is due to some implementation difference between .NET Framework 4.8 and .NET 6.0 that's incompatible with this HTTPS server?
It seems Pode has it's own HTTP Implementation (PodeHttpRequest.cs) and deals with TLS via use of SslStream (PodeRequest.cs) so maybe there is a Pode bug?
How do I fix or mitigate this? Is this issue on the client-side or server-side? My configuration or a bug?