Invoke-WebRequest: Vague error thrown, resulting from TLS issue

Steps to reproduce

Run Invoke-WebRequest -Uri https://internalwebsite.local (actual URL hidden for security)

Expected behavior

Web request succeeds, similar to how the web browser (eg. Google Chrome, Firefox, Safari) successfully opens the secured page.

Actual behavior

An exception is thrown:

Invoke-WebRequest : An error occurred while sending the request.
At line:1 char:1
+ Invoke-WebRequest https://internalwebsite.local
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (Method: GET, Re...rShell/6.0.0
}:HttpRequestMessage) [Invoke-WebRequest], HttpRequestException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

When I dig into the exception, I find:

PS /> $error[0].Exception.InnerException
Peer certificate cannot be authenticated with given CA certificates

Environment data

Name                           Value
----                           -----
PSVersion                      6.0.0-alpha
PSEdition                      Core
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   3.0.0.0
GitCommitId                    v6.0.0-alpha.14
CLRVersion
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Cheers,
Trevor Sullivan
Docker Captain
Microsoft MVP: Cloud & Data Center Management
https://trevorsullivan.net
https://twitter.com/pcgeek86

At the very least it would be nice if the error message surfaced the inner exception info.

Peer certificate cannot be authenticated with given CA certificates

It says that the server certificate is not valid. Should we add "DisableTLSCertificatesCheck"?

Ilya (@iSazonov)

Ilya (@iSazonov) the -SkipCertificateCheck switch is a workaround, but we should have a better error message here

the -SkipCertificateCheck switch is a workaround

It can be useful with self-signed certificates.

Got a fix, just need to add some tests:

PS /home/steve/repos/PowerShell> iwr https://incomplete.chain.badssl.com        
iwr : Peer certificate cannot be authenticated with given CA certificates
At line:1 char:1
+ iwr https://incomplete.chain.badssl.com
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (Method: GET, Re...rShell/6.0. 
   0
}:HttpRequestMessage) [Invoke-WebRequest], HttpRequestException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe 
   ll.Commands.InvokeWebRequestCommand

Do it makes sense to open a new Issue about -SkipCertificateCheck?

Ilya (@iSazonov)

Ilya (@iSazonov) can you be more specific about your issue with -SkipCertificateCheck? It allows a self-sogned cert currently

I was not accurate. My idea is that if the browsers are doing warning about bad certificates but allow us to make the choice to continue or cancel then we have to do something similar.

Ilya (@iSazonov)

Ilya (@iSazonov) so you want a prompt? not sure how useful that is since I expect most uses of the webcmdlets to be in script rather than interactive.

It seems a prompt may be breaking change.

I expect for request of URL with bad certificate:

By default - terminating error.
With -SkipCertificateCheck - warning.

Currently, by default it IS a terminating error:

PS /home/steve> iwr https://self-signed.badssl.com/                             
iwr : Peer certificate cannot be authenticated with given CA certificates
At line:1 char:1
+ iwr https://self-signed.badssl.com/
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (Method: GET, Re...rShell/6.0. 
   0
}:HttpRequestMessage) [Invoke-WebRequest], HttpRequestException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe 
   ll.Commands.InvokeWebRequestCommand

I don't think we should give a warning if -SkipCertificateCheck is used since it was explicitly specified:

PS /home/steve> iwr https://self-signed.badssl.com/ -SkipCertificateCheck       
                                                                                 Reading web response Reading response stream... (Number of bytes read: 477)    StatusCode        : 200                                                         
StatusDescription : OK
Content           : <!DOCTYPE html>
                    <html>
                    <head>
                      <meta name="viewport" content="width=device-width, 
                    initial-scale=1">
                      <link rel="shortcut icon" href="/icons/favicon-red.ico"/>
                      <link rel="apple-touch-icon" href="/i...
RawContent        : HTTP/1.1 200 OK
                    Server: nginx/1.10.0
                    Date: Thu, 16 Mar 2017 17:38:51 GMT
                    Transfer-Encoding: chunked
                    Connection: keep-alive
                    ETag: W/"58924b62-1dd"
                    Cache-Control: no-store
                    
                    <!DOCTYPE html>
                    <html>
                    <head>...
Forms             : 
Headers           : {[Server, System.String[]], [Date, System.String[]], 
                    [Transfer-Encoding, System.String[]], [Connection, 
                    System.String[]]...}
Images            : {}
InputFields       : {}
Links             : {}
ParsedHtml        : 
RawContentLength  : 477

Clear. Closed.

Navigation Menu

Repository navigation

Invoke-WebRequest: Vague error thrown, resulting from TLS issue #2942

Steps to reproduce

Expected behavior

Actual behavior

Environment data

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Invoke-WebRequest: Vague error thrown, resulting from TLS issue #2942

Description

Steps to reproduce

Expected behavior

Actual behavior

Environment data

Activity

rkeithhill commented on Dec 31, 2016

iSazonov commented on Mar 14, 2017

SteveL-MSFT commented on Mar 14, 2017

iSazonov commented on Mar 14, 2017

SteveL-MSFT commented on Mar 14, 2017

iSazonov commented on Mar 15, 2017

SteveL-MSFT commented on Mar 15, 2017

iSazonov commented on Mar 15, 2017

SteveL-MSFT commented on Mar 15, 2017

iSazonov commented on Mar 16, 2017

SteveL-MSFT commented on Mar 16, 2017

iSazonov commented on Mar 16, 2017

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions