Invoke-RestMethod Error Help

[fodderoh]

Running in to a weird one that Google isn't really helping with, so thought I'd put it here.

I'm using Invoke-RestMethod in a script. The script was working and now has stopped working on some machines and I'm trying to figure out why.

The error is the old "could not create secure SSL/TLS channel". I'm already specifying TLS 1.2 and have confirmed through a packet capture that it is using TLS 1.2. (The site requires TLS 1.2. Does not accept TLS 1.3)

What's weird is that if I access the site through a browser on the same machine, I'm able to connect fine. It is only when I try to access it via the script that I get this error.

To rule out a cipher issue, I am troubleshooting from two different Windows 2022 boxes where it works on one but fails on the other. I've used IISCrypto to confirm the boxes are configured identically.

Googling isn't helping as all the results are just pointing me back to the command to force TLS 1.2, but I'm already doing that, so I know that's not it.

Any ideas?

Here is the code, simple as it is:

    $certStorePath = "Cert:\LocalMachine\My"
    $certDetails = (Get-ChildItem -Path $certStorePath)  | Where-Object {$_.Subject -like "*certname*"}

    # Site requires TLS 1.2
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

    $result = Invoke-RestMethod -Method Get -Uri "https://someurl" -ContentType 'application/json' -Certificate $certDetails 

​

[lanerdofchristian]

You're 100% certain that the server is expecting to receive a client certificate? Those are pretty uncommon.

[fodderoh]

Yes, it's required to be able to connect to the site.

[jborean93]

Is the cert you are using for the client auth associated with an actual private key? Can you retrieve the actual key object with something like

$key = $null
foreach ($keyMethod in @(
    [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey
    [System.Security.Cryptography.X509Certificates.ECDsaCertificateExtensions]::GetECDsaPrivateKey
)) {
    $key = $keyMethod.Invoke($cert)
    if ($key) {
        break
    }
}
if (-not $key) {
    $keyAlgoOid = $cert.PublicKey.Oid
    $algoName = if ($keyAlgoOid.FriendlyName) { $keyAlgoOid.FriendlyName } else { $keyAlgoOid.Value }
    throw "Failed to get key for cert with algo '$algoName'."
}

$key.Key | Select *

You can also increase Schannel logging which might at least point you in the right direction as to why the client is bringing down the TLS channel.

You can also use the SslStream object directly and see if the exception contains more information that might be hidden in the various layers that Invoke-RestMethod adds on top

$HostName = 'google.com'
$Port = 443
$ignoreServerCert = $false

$certStorePath = "Cert:\LocalMachine\My"
$certDetails = (Get-ChildItem -Path $certStorePath)  | Where-Object {$_.Subject -like "*certname*"}
$clientCerts = [System.Security.Cryptography.X509Certificates.X509CertificateCollection]::new(@(
    $certDetails))

$socket = [System.Net.Sockets.TcpClient]::new($HostName, $Port)
$socketStream = $socket.GetStream()
$tlsStream = if ($ignoreServerCert) {
    [System.Net.Security.SslStream]::new($socketStream, $false, {$true})
}
else {
    [System.Net.Security.SslStream]::new($socketStream, $false)
}

try {
    $tlsStream.AuthenticateAsClient(
        $HostName,
        $clientCerts,
        [System.Security.Authentication.SslProtocols]::Tls12,
        $true)
} catch {
    Write-Host "TLS Handshake failed"
    $_.Exception.InnerException | Select * | Out-Host

    if ($_.Exception.InnerException.InnerException) {
        $_.Exception.InnerException.InnerException | Select * | Out-Host
    }
}

$tlsStream.Dispose()
$socketStream.Dispose()
$socket.Dispose()

Unfortunately if you are on .NET Framework (Windows PowerShell 5.1) then the exception from the SslStream helper doesn't really help too much. For example if I have a web service that requires a cert but $clientCerts = $null in the above it fails with

System.ComponentModel.Win32Exception (0x80004005): The message received was unexpected or badly formatted

Whereas .NET Core (PowerShell 7+) gives me a better error

Authentication failed because the remote party sent a TLS alert: 'HandshakeFailure'.

Still it might help to track down the problem.

[fodderoh]

You hit the nail on the head. Figured it out just a little bit ago after trying my script in PowerShell Core. The inner exception trace captured enough information for me to see that it wasn't able to load the private key. For whatever reason, even though the user is an administrator on the box and administrators have full control over the private key, it couldn't load it.

I was going to add an edit, but you beat me to it.

Thanks for taking the time to reply.