PowerShell requires you to set -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck)
This is because the builtin OMI client did not do any cert verification and they wanted the callers to be aware of this fact
Since v1.2.0 of this fork, certificate validation was enabled by default regardless of the -SessionOption value from PowerShell
The only way to opt out of this was through a global env var
This env var could not be set per session and required PInvoke to call setenv directly due to .NET's handling of env vars on non-Windows hosts
What this PR does is
Plumb in the logic for handling WSManSetSessionOption() for both the CA and CN skip options in psrpclient
Change OMI to use these options, if present, when setting up the verification work
Expose a way for PowerShell to check if the underlying libs support cert verification without any breaking changes
The first two will allow the -SkipC*Check options to pass down and actually work once PowerShell removes the hardcoded check. The last fix gives PowerShell a way to remove that hardcoded check when it knows the client supports certificate verification.
Ultimately this will allow an end user of this fork the ability to connect to a WSMan listener and feel secure that the proper verification work is in place but also allow them to disable those checks using the proper PowerShell way like they can do on Windows.
https://github.com/PowerShell/PowerShell/issues/13577 has more details on the background of this issue but there are 2 issues with cert verification with WSMan endpoints
-SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck)
-SessionOption
value from PowerShellsetenv
directly due to .NET's handling of env vars on non-Windows hostsWhat this PR does is
WSManSetSessionOption()
for both the CA and CN skip options inpsrpclient
The first two will allow the
-SkipC*Check
options to pass down and actually work once PowerShell removes the hardcoded check. The last fix gives PowerShell a way to remove that hardcoded check when it knows the client supports certificate verification.Ultimately this will allow an end user of this fork the ability to connect to a WSMan listener and feel secure that the proper verification work is in place but also allow them to disable those checks using the proper PowerShell way like they can do on Windows.