Support TLS 1.2 - "Could not create SSL/TLS secure channel"

[crazy4cs]

• [X] set-executionpolicy remotesigned -s currentuser has been ran
• [X] PowerShell 3 or greater is installed

  PS C:\WINDOWS\system32> $PSVersionTable.PSVersion
  Major  Minor  Build  Revision
  -----  -----  -----  --------
  5      1      16299  248

iex : Exception calling "DownloadFile" with "2" argument(s): "The request was aborted: Could not create SSL/TLS secure
channel."
At line:1 char:1
+ iex (new-object net.webclient).downloadstring('https://get.scoop.sh')
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Invoke-Expression], MethodInvocationException
    + FullyQualifiedErrorId : WebException,Microsoft.PowerShell.Commands.InvokeExpressionCommand

The scoop directory is created within the user profile folder, as well as the %USERPROFILE%\scoop\apps\scoop\current directory, however, they are both empty.

[hss-dev]

My colleague has just tried to install Scoop and also got this problem. I installed it last week and it was fine.

[r15ch13]

What's the output of Get-ExecutionPolicy -List?

[hss-dev]

My colleagues settings were

   Scope ExecutionPolicy
   ----- ---------------

MachinePolicy Undefined UserPolicy Undefined Process Undefined CurrentUser RemoteSigned LocalMachine RemoteSigned

[ghost]

Hello I'm having the same issue

[r15ch13]

Whats the output of [Net.ServicePointManager]::SecurityProtocol?

[ghost]

PS C:\Users\chere> [Net.ServicePointManager]::SecurityProtocol Ssl3, Tls PS C:\Users\chere>

[ghost]

And if I try to install it again it says:

PS C:\Users\chere> iex (new-object net.webclient).downloadstring('https://get.scoop.sh') Initializing... Scoop is already installed. Run 'scoop update' to get the latest version. PS C:\Users\chere> scoop update scoop : The term 'scoop' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At line:1 char:1

• scoop update

• 
  + CategoryInfo          : ObjectNotFound: (scoop:String) [], ParentContainsErrorRecordException
  + FullyQualifiedErrorId : CommandNotFoundException

PS C:\Users\chere>

[covertcj]

I just ran into this as well on a 'fresh' install of Windows 10 (it was installed from a base image provided by the IT dept, for whatever that's worth). I found that I was able to delete the ~/scoop directory, run the command:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

directly in my prompt, and then re-install with the standard method. That being said, it seems I need to re-run that command in each new powershell window, or I see a bunch of SSL/TLS errors any time I use scoop.

[masaeedu]

You can put [Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls" in your Powershell profile (notepad $PROFILE) as a workaround. It seems like something's changed on github's side so they no longer accept TLSv1, which winhttp uses by default. There's also stuff you can fiddle with in the registry to get winhttp to use TLSv1.2 instead.

EDIT: Looks like installing .NET 4.6.1 also changes the default TLS scheme to 1.2.

[tresf]

Just updated Windows 10 today and I'm receiving this. I've tried the above suggestions without much luck, although the symptoms are the same, my error is a bit different.

PS C:\Users\Tres> scoop update
Updating Scoop...
fatal: unable to access 'https://github.com/lukesampson/scoop/': error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version
Update failed.

I've tried setting the registry flag to force WinHttp to a higher TLS version, but it's not working on my machine or perhaps my steps are incorrect.

The suggestion to use notepad $PROFILE doesn't seem to work on my installation, I'm not sure what that does. My scoop version is ef058e9 Update fnproject to version 0.4.34.

[masaeedu]

@tresf notepad $PROFILE doesn't do anything by itself, it's just supposed to open your Powershell profile file for editing. In that file you need to add [Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls". Before adding it to your profile file, you can test out whether the incorrect TLS version is causing your issue by just running this command in a powershell session right before scoop update.

[tresf]

you can test out whether the incorrect TLS version is causing your issue by just running this command in a powershell session right before scoop update.

I wasn't able to get either proposal to help...

• [Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"
• [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

I also removed ~/scoop and reinstalled through the iex ... command from scoop.sh, which worked, but once scoop update was run, the tlsv1 alert protocol version error comes back.

@tresf notepad $PROFILE doesn't do anything by itself, it's just supposed to open your Powershell profile file for editing.

Thanks for explaining. The command didn't work on my machine. I'm happy to know it's the same effect as setting the properties via PowerShell command line, so I won't worry about it at this time.

[tresf]

PS C:\Users\Tres> scoop update
Updating Scoop...
fatal: unable to access 'https://github.com/lukesampson/scoop/': error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version
Update failed.

Apologies... My issue was a botched git-scm after the Windows 10 updates. The fix was to completely purge all git versions and reinstall. Interestingly enough, the default git location changed from C:\Program Files (x86)\ to C:\Program Files\ but my system did not reflect it, so this seems to be unrelated to the original bug report and fixed by repairing git through some manual steps. The symptoms and timing were very close to the original bug report, so I thought they were related, but they appear to be different.

[jordanbtucker]

@masaeedu Is there a work around for this when using the command prompt? Having to use scoop exclusively in PowerShell is inconvenient.

[r15ch13]

Scoop has the following functions to enable every available protocol when downloading apps: https://github.com/lukesampson/scoop/blob/f8f08db7e53f624b4c81f5d61e8d16c8176a13a7/lib/install.ps1#L117-L133

Currently they are only used in do_dl(), checkver.ps1 and checkurls.ps1 https://github.com/lukesampson/scoop/blob/f8f08db7e53f624b4c81f5d61e8d16c8176a13a7/lib/install.ps1#L135-L149

Adding them to all other commands that require downloading something could fix it. It has to be set manually for the initial scoop installation to work.

[chawyehsu]

https://github.com/blog/2507-weak-cryptographic-standards-removed Does the change of GitHub affect this issue?

AFAIK, the scoop installer script is hosted by GitHub.

[r15ch13]

@h404bi that is the main cause of this issue 😁

https://get.scoop.sh redirects to https://raw.githubusercontent.com/lukesampson/scoop/master/bin/install.ps1

[kvnklk]

Currently using this in a .bat on fresh installed systems:

@echo off
COLOR 1F

set filePath="%userprofile%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1"

IF EXIST $filePath (GOTO appendTLS) else (GOTO newTLS)

:appendTLS
(
echo.
echo [Net.ServicePointManager]::SecurityProtocol = ^"tls12, tls11, tls^"
) >> "%filePath%"

:newTLS
mkdir "%userprofile%\Documents\WindowsPowerShell\"
(
echo [Net.ServicePointManager]::SecurityProtocol = ^"tls12, tls11, tls^"
) > "%filePath%"

@"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -InputFormat None -ExecutionPolicy RemoteSigned -Command "iex (new-object net.webclient).downloadstring('https://get.scoop.sh')"

But obviously need Set-ExecutionPolicy RemoteSigned -s cu

[tresf]

@tresf notepad $PROFILE doesn't do anything by itself, it's just supposed to open your Powershell profile file for editing.

Turns out this command fails on systems without a ~/PowerShell folder.

I ran into this today with Windows 7 SP1. Here's a little script that should help.

mkdir $PROFILE\..
echo '[Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"' >> $PROFILE
& $PROFILE
# thats it

[sharh]

Prepare, do this in PowerShell:

set-executionpolicy remotesigned -s currentuser

And input Y to ensure.

---

Open https://get.scoop.sh in your browser to download the shellscript, save as install.ps1:

#requires -v 3

# remote install:
#   iex (new-object net.webclient).downloadstring('https://get.scoop.sh')
$erroractionpreference = 'stop' # quit if anything goes wrong

if(($PSVersionTable.PSVersion.Major) -lt 3) {
    Write-Output "PowerShell 3 or greater is required to run Scoop."
    Write-Output "Upgrade PowerShell: https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-windows-powershell"
    break
}

# show notification to change execution policy:
if((get-executionpolicy) -gt 'RemoteSigned') {
    Write-Output "PowerShell requires an execution policy of 'RemoteSigned' to run Scoop."
    Write-Output "To make this change please run:"
    Write-Output "'Set-ExecutionPolicy RemoteSigned -scope CurrentUser'"
    break
}

# get core functions
$core_url = 'https://raw.github.com/lukesampson/scoop/master/lib/core.ps1'
Write-Output 'Initializing...'
Invoke-Expression (new-object net.webclient).downloadstring($core_url)

# prep
if(installed 'scoop') {
    write-host "Scoop is already installed. Run 'scoop update' to get the latest version." -f red
    # don't abort if invoked with iex——that would close the PS session
    if($myinvocation.mycommand.commandtype -eq 'Script') { return } else { exit 1 }
}
$dir = ensure (versiondir 'scoop' 'current')

# download scoop zip
$zipurl = 'https://github.com/lukesampson/scoop/archive/master.zip'
$zipfile = "$dir\scoop.zip"
Write-Output 'Downloading...'
dl $zipurl $zipfile

'Extracting...'
unzip $zipfile "$dir\_tmp"
Copy-Item "$dir\_tmp\scoop-master\*" $dir -r -force
Remove-Item "$dir\_tmp" -r -force
Remove-Item $zipfile

Write-Output 'Creating shim...'
shim "$dir\bin\scoop.ps1" $false

ensure_robocopy_in_path
ensure_scoop_in_path
success 'Scoop was installed successfully!'
Write-Output "Type 'scoop help' for instructions."

find $zipurl:

$zipurl = 'https://github.com/lukesampson/scoop/archive/master.zip'

Find zipurl: https://github.com/lukesampson/scoop/archive/master.zip, download it, and unzip it in the scoop's dir: %USERPROFILE%\scoop\apps\scoop\current

Or you can change the install.ps1 script, to see where scoop dir is:

Write-Output 'Downloading...'
# this will print scoop dir
Write-Output '$dir'

Then modify the install.ps1，it should be below:

#requires -v 3

# remote install:
#   iex (new-object net.webclient).downloadstring('https://get.scoop.sh')
$erroractionpreference = 'stop' # quit if anything goes wrong

if(($PSVersionTable.PSVersion.Major) -lt 3) {
    Write-Output "PowerShell 3 or greater is required to run Scoop."
    Write-Output "Upgrade PowerShell: https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-windows-powershell"
    break
}

# show notification to change execution policy:
if((get-executionpolicy) -gt 'RemoteSigned') {
    Write-Output "PowerShell requires an execution policy of 'RemoteSigned' to run Scoop."
    Write-Output "To make this change please run:"
    Write-Output "'Set-ExecutionPolicy RemoteSigned -scope CurrentUser'"
    break
}

# get core functions
$core_url = 'https://raw.github.com/lukesampson/scoop/master/lib/core.ps1'
Write-Output 'Initializing...'
Invoke-Expression (new-object net.webclient).downloadstring($core_url)

# prep
$dir = ensure (versiondir 'scoop' 'current')
Write-Output "$dir"
# download scoop zip
# $zipurl = 'https://github.com/lukesampson/scoop/archive/master.zip'
$zipfile = "$dir\scoop.zip"
# Write-Output 'Downloading...'
# comment dl command, download zipfile yourself.
# dl $zipurl $zipfile

'Extracting...'
# notice to comment unzip, otherwise there will be an error of unzip. You should unzip with winrar yourself
# the zip file should unzip in $dir\_tmp yourself
# unzip $zipfile "$dir\_tmp"
Copy-Item "$dir\_tmp\scoop-master\*" $dir -r -force
Remove-Item "$dir\_tmp" -r -force
Remove-Item $zipfile

Write-Output 'Creating shim...'
shim "$dir\bin\scoop.ps1" $false

ensure_robocopy_in_path
ensure_scoop_in_path
success 'Scoop was installed successfully!'
Write-Output "Type 'scoop help' for instructions."

save install.ps1, then drag it into PowerShell, and then press enter, after a moment: Scoop was installed successfully!

[chawyehsu]

One line PowerShell command for new installation, if someone is looking for workaround:

set-executionpolicy remotesigned -s currentuser; [System.Net.ServicePointManager]::SecurityProtocol = 3072 -bor 768 -bor 192 -bor 48; iwr https://get.scoop.sh -UseBasicParsing | iex

[danielgary]

If I had to guess, the schoop.sh website is probably using a certificate from StartSSL. As they are no longer a trusted cert authority, the download is failing. If you browse to https://scoop.sh you'll get a security warning about the certificate. Should be easy to fix with a new certificate using letsencrypt or something similar.

[chawyehsu]

@danielgary nope, scoop.sh didn't have ssl, it's a CNAME of scoop's gh-pages. And https://get.scoop.sh redirects to https://raw.githubusercontent.com/lukesampson/scoop/master/bin/install.ps1

GitHub drops TLSv1 support cause this issue.

[r15ch13]

@danielgary ugh, thanks for pointing this out. I contacted @lukesampson about this.

[masaeedu]

@h404bi I don't think the one line solution will work, scoop frequently consults the buckets (which are on github), post-install. This means you need to have the TLS settings in every powershell instance you start; i.e. you need to put it in your profile.

[chawyehsu]

@masaeedu I said that's a workaround for fresh installation. Though I have tested on a fresh install windows 10, fresh install scoop with that command, then just install git-with-openssh, every thing seems fine, scoop update, scoop search, scoop status...

The Windows 10 ServicePointManager:

$ [System.Net.ServicePointManager]::SecurityProtocol
Ssl3, Tls

Besides, I search that we could modify the registry of ServicePointManager to permanently force to use strong cryptography, but that's inconvenient and it needs elevated privileges, which is worse.1

[tresf]

Besides, I search that we could modify the registry of ServicePointManager to permanently force to use strong cryptography, but that's inconvenient and it needs elevated privileges, which is worse.1

Do you mean for all users? For the current user, https://github.com/lukesampson/scoop/issues/2040#issuecomment-368145842, @covertcj's solution works great. I've adapted @r15ch13's proposal to make it permanent for the current user and this technique was tested on Windows 7.

Is the concern that this won't scale for multiple users? I would propose that the scoop library internally nudges this since it makes no sense to attempt to continue functioning otherwise.

Even the set-executionpolicy remotesigned -s currentuser, I don't entirely understand as this is part of the base scoop.sh install, this command should already have been run 100% of the time adding it to this thread seems like it will only confuse first time users.

[jordanbtucker]

@h404bi While I agree that scoop should just work, setting ServicePointManager to only use TLS 1.1 and higher is something you should do anyway since SSLv3 and TLSv1.0 are deprecated due to POODLE. (Although, this could break other .NET applications and libraries.)

Here's how to do that in PowerShell:

# set strong cryptography on 64 bit .Net Framework (version 4 and above)
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord

# set strong cryptography on 32 bit .Net Framework (version 4 and above)
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord 

Plus, this will allow scoop to work in Command Prompt instead of just PowerShell.

[r15ch13]

Was not sure if every site supports TLS 1.2 therefore I created a script to checks all the URLs. Every single hosts supports it, so it's safe to just enable it I guess.

Script:

protocol-test.ps1

```powershell param( [String]$Dir = "$PSScriptRoot\..\bucket", [String]$App = '*' ) . "$PSScriptRoot\..\lib\core.ps1" . "$PSScriptRoot\..\lib\buckets.ps1" . "$PSScriptRoot\..\lib\manifest.ps1" . "$PSScriptRoot\..\lib\json.ps1" # https://www.sysadmins.lv/blog-en/test-web-server-ssltls-protocol-support-with-powershell.aspx function Test-ServerSSLSupport($HostName) { $Port = 443 $RetValue = New-Object psobject -Property @{ Host = $HostName Port = $Port ssl2 = $false ssl3 = $false tls = $false tls11 = $false tls12 = $false KeyExhange = $null HashAlgorithm = $null } # "ssl2", "ssl3", "tls", "tls11", "tls12" | ForEach-Object { $TcpClient = New-Object Net.Sockets.TcpClient $TcpClient.Connect($RetValue.Host, $RetValue.Port) try { $SslStream = New-Object Net.Security.SslStream $TcpClient.GetStream() } catch { write-host $_.Message return $RetValue } $SslStream.ReadTimeout = 15000 $SslStream.WriteTimeout = 15000 try { $SslStream.AuthenticateAsClient($RetValue.Host, $null, $_, $false) $RetValue.KeyExhange = $SslStream.KeyExchangeAlgorithm $RetValue.HashAlgorithm = $SslStream.HashAlgorithm $status = $true } catch { $status = $false } $RetValue.$_ = $status # dispose objects to prevent memory leaks $TcpClient.Dispose() $SslStream.Dispose() } return $RetValue } function Test-Url($url) { $url = [System.Uri]$url if(!$url) { return } if($url.Scheme -ne "https") { write-host -f DarkYellow "$($url.Host.PadRight(40, " "))" -NoNewline write-host " | http" return } $result = Test-ServerSSLSupport $url.Host write-host "$($url.Host.PadRight(40, " ")) | " -NoNewline if($result.tls) { write-host -f DarkGreen "$($result.tls.ToString().PadRight(6, " "))" -NoNewline } else { write-host -f DarkRed "$($result.tls.ToString().PadRight(6, " "))" -NoNewline } write-host " | " -NoNewline if($result.tls11) { write-host -f DarkGreen "$($result.tls11.ToString().PadRight(6, " "))" -NoNewline } else { write-host -f DarkRed "$($result.tls11.ToString().PadRight(6, " "))" -NoNewline } write-host " | " -NoNewline if($result.tls12) { write-host -f DarkGreen "$($result.tls12.ToString().PadRight(6, " "))" -NoNewline } else { write-host -f DarkRed "$($result.tls12.ToString().PadRight(6, " "))" -NoNewline } write-host "" } function Get-ManifestUrls($file) { $urls = @() if(!$file) { return $urls } $json = parse_json $file.FullName if(!$json) { return $urls } if ($json.url -is [System.Array]) { $json.url | ForEach-Object { $urls += [System.Uri]$_ } } elseif($json.url) { $urls += [System.Uri]$json.url } else { $arch_url = (arch_specific 'url' $json '64bit') if(!$arch_url) { $arch_url = (arch_specific 'url' $json '32bit') } if($arch_url -is [System.Array]) { $arch_url | ForEach-Object { $urls += [System.Uri]$_ } } else { $urls += [System.Uri]$arch_url } } return $urls } # get apps to check write-host "Host | TLSv10 | TLSv11 | TLSv12" write-host "-------------------------------------------------------------------" $urls = @() Get-ChildItem -Path $Dir "$App.json" | ForEach-Object { Get-ManifestUrls($_) | ForEach-Object { $urls += $_ } } $urls | Sort-Object -Property @{Expression={$_.Host}} -Unique | ForEach-Object { Test-Url $_ } ```

Results:

Main Bucket Hosts

``` Main Bucket Hosts | TLSv10 | TLSv11 | TLSv12 ------------------------------------------------------------------- 7-zip.org | True | True | True adoxa.altervista.org | http amazon-eks.s3-us-west-2.amazonaws.com | True | True | True archive.apache.org | True | True | True archive.mozilla.org | True | True | True azuredraft.blob.core.windows.net | True | True | True beyondgrep.com | True | True | True bin.equinox.io | True | True | True binaries.cockroachdb.com | False | True | True binaries.sonarsource.com | False | False | True bitbucket.org | False | False | True blog.alivate.com.au | http cdn.mysql.com | True | True | True cdn.theunarchiver.com | True | True | True chromedriver.storage.googleapis.com | True | True | True cmake.org | False | True | True constexpr.org | http cran.rstudio.com | False | True | True curl.haxx.se | False | False | True cygwin.com | True | True | True dev.mysql.com | False | False | True developers.yubico.com | False | False | True digi.bib.uni-mannheim.de | True | True | True dist.nuget.org | True | True | True dl.bintray.com | False | False | True dl.google.com | True | True | True dl.influxdata.com | True | True | True dl.minio.io | False | True | True dotnetcli.blob.core.windows.net | True | True | True download.handbrake.fr | False | False | True download.jetbrains.com | True | True | True download.linuxaudio.org | True | True | True download.microsoft.com | True | True | True download.mono-project.com | True | True | True download.qt.io | False | False | True download.rethinkdb.com | True | True | True download.savannah.gnu.org | True | True | True download.videolan.org | True | True | True downloads.dlang.org | http downloads.kitenet.net | True | True | True downloads.mariadb.org | True | False | False downloads.plex.tv | True | True | True downloads.puppetlabs.com | True | True | True downloads.rclone.org | False | False | True downloads.sourceforge.net | False | True | True downloads.typesafe.com | False | True | True downloads.xiph.org | True | True | True doxygen.nl | http drive.google.com | True | True | True erlang.org | http eternallybored.org | True | True | True eventstore.org | True | True | True farmanager.com | False | False | True fastdl.mongodb.org | False | True | True ffmpeg.zeranoe.com | True | True | True files.genshin.org | http fossies.org | True | True | True frippery.org | True | True | True ftp.equation.com | http ftp.fau.de | True | True | True ftp.gnome.org | True | True | True ftp.gnu.org | False | False | True ftp.isc.org | True | True | True get.enterprisedb.com | False | True | True get.gravitational.com | True | True | True getcomposer.org | True | True | True github.com | False | False | True gitlab-runner-downloads.s3.amazonaws.com | True | True | True gittup.org | http go.microsoft.com | True | True | True graphviz.gitlab.io | True | True | True hashcat.net | True | True | True haskell.org | True | True | True invisible-island.net | False | False | True iperf.fr | False | False | True jfrog.bintray.com | False | False | True julialang-s3.julialang.org | False | False | True khudob.in.s3-website-us-west-2.amazonaws.com | http mark0.net | http master.dockerproject.org | True | True | True mediaarea.net | True | True | True megatools.megous.com | True | True | True mran.blob.core.windows.net | True | True | True nekovm.org | False | True | True neon.se | True | True | True nginx.org | True | True | True nim-lang.org | True | True | True nmap.org | True | True | True nodejs.org | True | True | True nssm.cc | False | False | True nuget.org | True | True | True packages.chocolatey.org | True | True | True pngquant.org | True | True | True potrace.sourceforge.net | http projects.giacomodrago.com | True | True | True qemu.weilnetz.de | True | True | True r15ch13.keybase.pub | True | True | True raw.githubusercontent.com | True | True | True releases.hashicorp.com | False | False | True releases.llvm.org | False | False | True repo.maven.apache.org | False | False | True repo.msys2.org | http repo1.maven.org | False | False | True rtmpdump.mplayerhq.hu | True | True | True s3.amazonaws.com | True | True | True scholarlymarkdown.com | http selenium-release.storage.googleapis.com | True | True | True services.gradle.org | True | True | True shellcheck.storage.googleapis.com | True | True | True sliksvn.com | True | True | True slproweb.com | True | True | True sourceforge.net | False | True | True static.red-lang.org | True | True | True static.rust-lang.org | False | True | True storage.googleapis.com | True | True | True strawberryperl.com | http svtplay-dl.se | True | True | True sysprogs.com | True | True | True tukaani.org | False | True | True unbound.net | True | True | True win.rustup.rs | False | True | True windows.php.net | False | True | True www.andre-simon.de | http www.apache.org | False | False | True www.autoitscript.com | True | True | True www.benf.org | True | True | True www.chrysocome.net | http www.cjmweb.net | False | True | True www.cs.utah.edu | True | True | True www.dropbox.com | True | True | True www.engr.mun.ca | True | False | False www.fossil-scm.org | True | True | True www.glob.com.au | True | True | True www.gnupg.org | True | True | True www.guysalias.tk | True | True | True www.imagemagick.org | True | True | True www.mercurial-scm.org | True | True | True www.mls-software.com | True | True | True www.nano-editor.org | True | True | True www.nasm.us | http www.nirsoft.net | True | True | True www.nuget.org | True | True | True www.pdflabs.com | True | True | True www.python.org | False | False | True www.rarewares.org | http www.rarlab.com | True | True | True www.sentex.net | http www.sqlite.org | True | True | True www.syncany.org | True | True | True www.tortall.net | http www.videohelp.com | True | True | True www-us.apache.org | False | False | True xpdfreader-dl.s3.amazonaws.com | True | True | True yarnpkg.com | True | True | True ```

Extras Bucket Hosts

``` Extras Bucket Hosts | TLSv10 | TLSv11 | TLSv12 ------------------------------------------------------------------- 1.eu.dl.wireshark.org | True | True | True 3rvx.com | True | True | True abstractspoon.pbwiki.com | False | False | False aezay.dk | http antibody-software.com | True | True | True api.nuget.org | True | True | True app.pc.kakao.com | http app.prntscr.com | True | True | True apps.ankiweb.net | True | True | True archive.apache.org | True | True | True artifacts.elastic.co | False | False | True azurecliprod.azureedge.net | False | False | True binaries.mpc-hc.org | True | True | True bit.ly | True | True | True bitbucket.org | False | False | True bliskcloudstorage.blob.core.windows.net | True | True | True buildbot.libretro.com | True | True | True camunda.org | True | True | True cdn.chuyu.me | http cdn.gogs.io | False | False | True cdn09.foxitsoftware.com | True | True | True cdnverify.eta-lang.org | True | True | True central.github.com | True | True | True chocolatey.org | True | True | True ci.appveyor.com | True | True | True cli.run.pivotal.io | False | True | True cli-assets.heroku.com | True | True | True clis.ng.bluemix.net | False | False | True cmake.org | False | True | True codeload.github.com | False | False | True crawl.develz.org | True | True | True dbeaver.io | False | False | True desktop.icons8.com | True | True | True developer.arm.com | False | True | True developers.yubico.com | False | False | True dist.ipfs.io | False | False | True dist.torproject.org | True | True | True dl.4players.de | http dl.bandisoft.com | True | True | True dl.bintray.com | False | False | True dl.discordapp.net | http dl.eagleget.com | http dl.enpass.io | False | True | True dl.google.com | True | True | True dl.hexchat.net | True | True | True dl.nwjs.io | True | True | True dl.pstmn.io | True | True | True dl.slic3r.org | True | True | True dl.winsshterm.net | http dl.yat.qa | True | True | True dl5.oo-software.com | True | False | False dl-canary.discordapp.net | http dl-ptb.discordapp.net | http dlsrc.getmonero.org | True | True | True download.aida64.com | http download.anydesk.com | True | True | True download.bleachbit.org | True | True | True download.blender.org | True | True | True download.ccleaner.com | True | True | True download.cdburnerxp.se | False | False | True download.cpuid.com | http download.deluge-torrent.org | http download.filezilla-project.org | True | True | True download.geany.org | http download.gimp.org | True | True | True download.gnome.org | True | True | True download.handbrake.fr | False | False | True download.jetbrains.com | True | True | True download.kde.org | False | False | True download.knime.org | True | True | True download.linqpad.net | http download.microsoft.com | True | True | True download.mobatek.net | True | True | True download.mozilla.org | True | True | True download.mp3tag.de | True | True | True download.msi.com | http download.nirsoft.net | True | True | True download.nomacs.org | http download.robomongo.org | True | True | True download.sourcegear.com | http download.springsource.com | True | True | True download.sublimetext.com | True | True | True download.svcat.sh | True | True | True download.sysinternals.com | True | True | True download.teamviewer.com | True | True | True download.videolan.org | True | True | True download.virtualbox.org | True | True | True download.visualstudio.microsoft.com | True | True | True download.zotero.org | True | True | True download1.operacdn.com | True | True | True download1.rstudio.org | True | True | True download2.mikrotik.com | True | True | True downloadarchive.documentfoundation.org | http download-eu2.guru3d.com | True | True | True downloads.arduino.cc | True | True | True downloads.mongodb.com | False | True | True downloads.ortussolutions.com | True | True | True downloads.plex.tv | True | True | True downloads.slack-edge.com | True | True | True downloads.sourceforge.net | False | True | True downloads.tuxfamily.org | True | True | True downloads.vivaldi.com | True | True | True encdn.ldmnq.com | True | True | True enclose.io | http endpoint920510.azureedge.net | True | True | True fastcopy.jp | True | True | True fastglacier.com | True | True | True files.gpg4win.org | True | True | True files.kde.org | False | False | True files.vbox.me | http findandreplace.io | http fishcodelib.com | True | True | True flatassembler.net | True | True | True fmedia.firmdev.com | http foicica.com | True | False | False fossies.org | True | True | True freecommander.com | True | True | True friedrich-folkmann.de | http fritzing.org | http ftp.musicbrainz.org | http ftp.ncftp.com | http ftpmirror.gnu.org | True | True | True geekuninstaller.com | True | True | True gist.github.com | False | False | True gist.githubusercontent.com | True | True | True git-fork.com | True | True | True github.com | False | False | True glogg.bonnefon.org | True | True | True go.microsoft.com | True | True | True graphicsgale.com | True | True | True hammultiplayer.org | http iamfutureproof.com | http icon-icons.com | True | True | True inkscape.org | True | True | True installer.jdownloader.org | http jdownloader.org | http jigsaw.w3.org | True | True | True justgetflux.com | True | True | True kindlegen.s3.amazonaws.com | True | True | True lechnology.com | True | True | True leomoon.com | True | True | True lighttpd.dtech.hu | http lockhunter.com | True | True | True lpb.canb.auug.org.au | http media2.steampowered.com | http mediaarea.net | True | True | True mega.nz | True | True | True mh-nexus.de | True | True | True mirror.httrack.com | True | True | True mkvtoolnix.download | False | False | True mpv.srsfckn.biz | False | False | True multicommander.com | http mupdf.com | True | True | True nimbletext.com | http nl1-dl.techpowerup.com | http notepad-plus-plus.org | True | True | True oneget.org | True | True | True openhardwaremonitor.org | True | True | True openresty.org | True | True | True osdn.net | True | True | True out7.hex-rays.com | False | False | True packages.chef.io | True | True | True packages.chocolatey.org | True | True | True pcem-emulator.co.uk | True | True | True p-nand-q.com | http public.dhe.ibm.com | True | True | True quiterss.org | True | True | True r15ch13.keybase.pub | True | True | True rammichael.com | True | True | True raw.githubusercontent.com | True | True | True redirector.gvt1.com | True | True | True rei.to | http release.gitkraken.com | True | True | True release.tinymediamanager.org | http releases.mattermost.com | True | True | True renderdoc.org | True | True | True repo.continuum.io | True | True | True repo.spring.io | False | False | True reshade.me | False | True | True riot.im | True | True | True rm-eu.palemoon.org | http s3.amazonaws.com | True | True | True s3-us-west-2.amazonaws.com | True | True | True search.maven.org | http sites.google.com | True | True | True slobs-cdn.streamlabs.com | True | True | True snapshots.mitmproxy.org | False | True | True soft.rubypdf.com | http software-download.microsoft.com | True | True | True sourceforge.net | False | True | True sqlitestudio.pl | True | True | True static.azul.com | http static.rust-lang.org | False | True | True steamcdn-a.akamaihd.net | True | True | True storage.googleapis.com | True | True | True storage-waterfox.netdna-ssl.com | True | True | True swupdate.openvpn.org | True | True | True sysprogs.com | True | True | True taiga.moe | True | True | True telerik-fiddler.s3.amazonaws.com | True | True | True the.earth.li | True | True | True totalcommander.ch | http typora.io | True | True | True updates.signal.org | True | True | True us.basilisk-browser.org | http vibrancegui.com | True | True | True vps2.highrez.co.uk | True | True | True vscode-update.azurewebsites.net | False | False | True wavebox.pro | True | True | True web.whatsapp.com | True | True | True winaero.com | True | True | True windirstat.mirror.wearetriple.com | True | True | True www.1space.dk | http www.2brightsparks.com | True | True | True www.9bis.net | True | True | True www.advancedrenamer.com | False | False | True www.alcpu.com | http www.almico.com | http www.angusj.com | http www.apache.org | False | False | True www.archimatetool.com | True | True | True www.bahraniapps.com | http www.baremetalsoft.com | False | True | True www.claws-mail.org | True | True | True www.cockos.com | True | True | True www.crystalidea.com | True | True | True www.cuetools.net | http www.dbvis.com | http www.dependencywalker.com | http www.dhcpserver.de | http www.digimezzo.com | False | True | True www.dotpdn.com | True | True | True www.eclipse.org | True | True | True www.faststonesoft.net | http www.firstobject.com | http www.flos-freeware.ch | http www.freeclipboardviewer.com | http www.getcodetrack.com | http www.giuspen.com | False | False | True www.haskell.org | True | True | True www.heidisql.com | True | True | True www.heidoc.net | True | True | True www.hwinfo.com | True | True | True www.iographica.com | http www.irfanview.info | True | True | True www.jrsoftware.org | http www.kymoto.org | False | True | True www.libsdl.org | True | True | True www.linuxliveusb.com | True | True | True www.listary.com | True | True | True www.makemkv.com | True | True | True www.mediafire.com | True | True | True www.mega-nerd.com | http www.mersenne.org | True | True | True www.microsip.org | True | True | True www.nattyware.com | http www.naturaldocs.org | http www.ocenaudio.com | False | True | True www.pcfreetime.com | http www.pci-z.com | True | True | True www.phraseexpress.com | True | True | True www.piriform.com | False | False | True www.portablefreeware.com | True | True | True www.ppsspp.org | True | True | True www.prime-expert.com | True | True | True www.proxifier.com | True | True | True www.pspad.com | True | True | True www.rapidee.com | True | True | True www.rarlab.com | True | True | True www.realvnc.com | False | True | True www.reaper.fm | True | True | True www.scootersoftware.com | False | False | True www.skytopia.com | http www.slsknet.org | True | True | True www.softwareok.com | True | True | True www.sordum.org | True | True | True www.sourcetreeapp.com | True | True | True www.sql-workbench.eu | True | True | True www.strokesplus.com | True | True | True www.stunnel.org | True | True | True www.sumatrapdfreader.org | False | False | True www.swi-prolog.org | http www.texmacs.org | http www.tt-solutions.com | http www.uderzo.it | http www.uwamp.com | True | True | True www.videohelp.com | True | True | True www.voidtools.com | True | True | True www.wagnardsoft.com | False | False | True www.willuhn.de | True | True | True www.xiles.net | http www.xm1math.net | http www.xmedia-recode.de | True | True | True www.xmind.net | True | True | True www.xyplorer.com | True | True | True www.yworks.com | http xdebug.org | False | False | True xmlsoft.org | http ```

Version Bucket Hosts

``` Version Bucket Hosts | TLSv10 | TLSv11 | TLSv12 ------------------------------------------------------------------- archive.apache.org | True | True | True artifacts.elastic.co | False | False | True beta.rclone.org | False | False | True bitbucket.org | False | False | True cocl.us | False | True | True dev.mysql.com | False | False | True digi.bib.uni-mannheim.de | True | True | True dist.nuget.org | True | True | True dl.bintray.com | False | False | True download.elastic.co | False | False | True download.springsource.com | http downloads.mongodb.org | http downloads.sourceforge.net | False | True | True downloads.vivaldi.com | True | True | True fastdl.mongodb.org | False | True | True files.emule-project.net | True | True | True get.enterprisedb.com | False | True | True github.com | False | False | True megatools.megous.com | True | True | True nodejs.org | True | True | True packages.chocolatey.org | True | True | True r.windows.random.supplies | http repo.continuum.io | True | True | True repo.spring.io | False | False | True services.gradle.org | True | True | True slproweb.com | True | True | True windows.php.net | False | True | True www.apache.org | False | False | True www.python.org | False | False | True www.stunnel.org | True | True | True www.vordweb.co.uk | http xdebug.org | False | False | True ```

/Edit: Updated script and results (20190410)

[tresf]

I'm not sure what's more impressive... the speed in which you valided every script mirror supports TLS12, or the neat GitHub hide huge codeblock trick.

[r15ch13]

An easy fix could be to add this neat little line to core.ps1. Mentioned by @masaeedu in https://github.com/lukesampson/scoop/pull/2065#issuecomment-369669048

[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12

Sadly the initial install oneliner has to change.

[jordanbtucker]

@r15ch13 @lukesampson The install oneliner doesn't need to change unless Amazon CloudFront drops support for TLSv1.0 or GitHub drops support for TLSv1.0 on raw.githubusercontent.com.

get.scoop.sh is served from Amazon CloudFront servers, then redirects to raw.githubusercontent.com. GitHub only dropped support for TLSv1.0 on github.com and api.github.com.

The install oneliner doesn't have trouble downloading the install script, it just has trouble accessing api.github.com during the install.

TLDR; install.ps1 and core.ps1 need to be updated, but the oneliner doesn't need to change... yet.

That being said, the following oneliner is shorter, but suffers from the same problem.

iwr https://get.scoop.sh | iex

[dsbert]

I didn't see a commit related to this but I am no longer receiving the error after updating scoop.

[jordanbtucker]

@dsbert What happens when you run this:

scoop search --no-cache

[dsbert]

@jordanbtucker There it is

[jordanbtucker]

This is fixed for me, but I left a comment about it leaving side effects. It's probably not a big deal though.

[ghost]

rtgsd

[wbrewer]

@h404bi While I agree that scoop should just work, setting ServicePointManager to only use TLS 1.1 and higher is something you should do anyway since SSLv3 and TLSv1.0 are deprecated due to POODLE. (Although, this could break other .NET applications and libraries.)

Here's how to do that in PowerShell:

# set strong cryptography on 64 bit .Net Framework (version 4 and above)
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord

# set strong cryptography on 32 bit .Net Framework (version 4 and above)
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord 

Plus, this will allow scoop to work in Command Prompt instead of just PowerShell.

This finally let me install boxstarter on windows7 via azure-arm/packer.