Authentication failed because the remote party sent a TLS alert: 'HandshakeFailure'

[calvinkatz]

🐛 Bug Report

Attempting to connect to Cohesity cluster using PowerShell Core gives the following error: "Authentication failed because the remote party sent a TLS alert: 'HandshakeFailure'"

To Reproduce

1. Open Windows Terminal
2. Enter connect command: Connect-CohesityCluster -Server "cluster.domain.com" -UseMFA
3. Enter login credentials/mfa code.

Expected behavior

Connection to cluster would establish.

Actual Behavior

Command immediately fails with the message:

Connect-CohesityCluster: Failed to connect to the Cohesity Cluster
The SSL connection could not be established, see inner exception.
Authentication failed because the remote party sent a TLS alert: 'HandshakeFailure'.
The message received was unexpected or badly formatted.

Environment

Windows 11 with PowerShell Core

 ~  $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.3.8
PSEdition                      Core
GitCommitId                    7.3.8
OS                             Microsoft Windows 10.0.22621
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

 ~  Get-Module -Name Cohesity*

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Binary     1.9.5                 Cohesity.PowerShell.Core            {Add-CohesityViewShare, Connect-CohesityCluster, …

Cohesity Cluster info:

• Software: 6.8.1_u3_release-20230509_1e641b74
• Hardware: Virtual Edition Cluster

[calvinkatz]

It appears PowerShell doesn't fallback to TLS 1.2, or even with specifying version: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Adding registry key to disabled TLS 1.3 and restarting shell resolved the issue.

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client\
DWORD: Enabled = 0