Jaykul / Tunable-SSL-Validator

A .Net class and PowerShell module to enable best practices for SSL validation even with self-signed certificates.
BSD 2-Clause "Simplified" License
57 stars 14 forks source link

Module does not always work #11

Closed kostapsimoulis closed 5 years ago

kostapsimoulis commented 5 years ago

Hello,

It appears that this module can help bypass some of the certificates but it doesn't always work.

For example, it works perfectly when connecting to HPE 3PAR api with self-signed certificated signed by HP but not with Redhat Satellite.

It generates the following error:

PS C:\tmp> Import-Module TunableSSLValidator
PS C:\tmp> [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12'
PS C:\tmp> Invoke-WebRequest -insecure -uri "https://sat01.reducteddomain.com/api/v2/hosts/544/subscriptions"
Server SSL Certificate:
   Server: sat01.reducteddomain.com
  Subject: CN=sat01.reducteddomain.com, OU=SomeOrgUnit, O=Katello, S=North Carolina, C=US
     Hash: 6B8616E14BD36A42EDD7CD3045C8B23E6AAF968B
Effective: 2015/10/06 16:17:42
  Expires: 2035/10/08 16:17:43
   Errors: RemoteCertificateChainErrors
 Rejected: To accept, use Add-SessionTrustedCertificate to map the certificate and hostmask. Use the -LastFailed paramet
er to do it automatically.
Invoke-WebRequest : The underlying connection was closed: Could not establish trust relationship for the SSL/TLS
secure channel.
At line:1 char:1
+ Invoke-WebRequest -insecure -uri "https://sat01.reducteddomain.com/api/v2/hos ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc
   eption
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

Powershell version: 5.1.14409.1018

Can you please help to resolve or to further debug this issue and understand why the behavior is not consistent?

kostapsimoulis commented 5 years ago

Issue is fixed by adding the following command:

Disable-SSLChainValidation