Could not establish trust relationship for the SSL/TLS secure channel with Invoke-Webrequest from PowerShell

Question

When I try to use Invoke-WebRequest on https, I'm getting some weird error:

Invoke-WebRequest : The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

Here is my code:

   [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls
    $url = "https://X.X.X.X:4343/officescan/console/html/cgi/cgiChkMasterPwd.exe"
    $r = Invoke-WebRequest $url -SessionVariable office

Any advice for me?

Possible duplicate of [Powershell v3 Invoke-WebRequest HTTPS error](https://stackoverflow.com/questions/11696944/powershell-v3-invoke-webrequest-https-error) — Sage Pourpre, Sep 13 '17 at 02:31
See the accepted answer: https://stackoverflow.com/a/15841856/934946 — Sage Pourpre, Sep 13 '17 at 02:31
Basically, if your SSL certificate is invalid or self-signed, you will have this error but you can "trust" all SSL certificate for your script so the error won't appear. — Sage Pourpre, Sep 13 '17 at 02:32

score 12 · Answer 1 · answered Sep 07 '21 at 13:19

Of course it is an issue with an invalid certificate (autosigned?, expired?) if using Powershell 7+ simply use the new parameter

Invoke-WebRequest -Uri 'https://trees.com/' -SkipCertificateCheck

if using Powershell 5.1 it is a bit harder:

$code= @"
        using System.Net;
        using System.Security.Cryptography.X509Certificates;
        public class TrustAllCertsPolicy : ICertificatePolicy {
            public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem) {
                return true;
            }
        }
"@
Add-Type -TypeDefinition $code -Language CSharp
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
Invoke-WebRequest -Uri 'https://trees.com/'

I added `using System;` and `Console.WriteLine(certificate.ToString(true));` and discovered a proxy performing a MITM on my WebRequest. — davenpcj, May 15 '23 at 16:55

score 1 · Answer 2 · edited May 18 '23 at 20:10

1

A possible solution I have seen is this:

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

you can override the certification validation function to always return true.

Its much simpler than overriding CheckValidationResult.

Credit

edited May 18 '23 at 20:10

Greg Burghardt

17,900
9
49
92

answered Mar 30 '23 at 13:01

Nir Yossef

191
1
8

This worked for me! – Ana J Jun 20 '23 at 17:42

score 0 · Answer 3 · answered Jul 11 '22 at 18:49

0

You should try this:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;
$url = "https://X.X.X.X:4343/officescan/console/html/cgi/cgiChkMasterPwd.exe"
$r = Invoke-WebRequest $url -SessionVariable office

answered Jul 11 '22 at 18:49

PollusB

1,726
2
22
31

score 0 · Answer 4 · answered Jan 24 '23 at 02:50

0

You can also try bypassing the PowerShell profile, in case there's something weird in there (my issue).

powershell -noprofile

answered Jan 24 '23 at 02:50

KERR

1,312
18
13

Could not establish trust relationship for the SSL/TLS secure channel with Invoke-Webrequest from PowerShell

4 Answers4