PowerShell Script - SSL/TLS secure channel fail

Question

I have been trying to communicate with a secure REST API using POST, passing the certificate correctly, but I keep receiving the error "The request was aborted: Could not create SSL/TLS secure channel" only on the production server.

I don't have the option to upgrade the Microsoft Windows Server 2008 R2.

Microsoft Framework 4.8 is installed, all patches have been applied, and all security protocols are enabled.

--running the same POST using POSTMAN on the server 2008 works perfectly

Do any of you know why PowerShell script isn't working on only the server?

Running the same Powershell script locally it works perfectly under windows 11

Do you guys have any suggestions? I've tried many things so far and nothing has worked :(

Thank you so much

Answer 1

You may need to ensure Tls1.2 is enabled for SCHANNEL in the registry. Start at this key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Tls12\Client

Create it if it doesn't already exist and make sure there's an Enabled dword set to 1. Also, any changes to the SCHANNEL configuration won't take effect until you restart the server.

Next, check that .Net is configured in the registry to use strong cryptographic protocols:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
      "SystemDefaultTlsVersions" = dword:00000001
      "SchUseStrongCrypto" = dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
      "SystemDefaultTlsVersions" = dword:00000001
      "SchUseStrongCrypto" = dword:00000001

Then this line in your PowerShell should actually be effective:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

---

But, as I indicated in a comment, you really should do whatever you need to get to permission to upgrade the server.

Windows Server 2008 R2 is fully end-of-life, and has been for several years now. This means it hasn't had any updates in that time... not even critical security patches, in spite of multiple active critical-rated CVEs. It's dangerous and irresponsible to still be using it; lawyers might use phrases like "gross negligence".

all patches have been applied...

I should hope so, as there haven't been any new patches released in several years.

The minimum safe version to be using today is Windows Server 2016 (2012 R2 also reaches end of life in less than a week.) This is the kind of thing worth finding a new job over, as you don't want to the be one held responsible when (not if) this thing is breached.

Answer 2

Alternatively, if upgrading is impossible, or you dont have Admin on the required machine, you may use curl for windows (the offical version, not the PS Alias) (https://curl.se/windows/) as it does include the necessary libraries for using TLS1.3

It may be a bit work to get curl to work with PS, as it does not have the same possibilities with "Web-Session" and other things built in, so you need to write yourself a wrapper for it to work, but its doable.