Skip to content

Commit 9f0c6ea

Browse files
committed
(MODULES-11334) Fix TLS error for agent downloads
Most modern sites either require or are starting to require TLS 1.2. On older Windows systems the default security protocols for PowerShell 5 are SSL3 and TLS 1.0. If using System.Net.WebClient, Invoke-WebRequest or Invoke-RestMethod to communicate with a site that has a higher TLS requirement requests will fail with the following error message: `Could not create SSL/TLS secure channel.` This commit adds a new function called Set-Tls12 that will add TLS 1.2 to the list of active security protocols for the current session. The above will only happen if the Tls12 enum is not present in the current list.
1 parent a5e5c0f commit 9f0c6ea

File tree

1 file changed

+15
-0
lines changed

1 file changed

+15
-0
lines changed

tasks/install_powershell.ps1

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,8 +105,23 @@ $date_time_stamp = (Get-Date -format s) -replace ':', '-'
105105
$msi_dest = Join-Path ([System.IO.Path]::GetTempPath()) "puppet-agent-$arch.msi"
106106
$install_log = Join-Path ([System.IO.Path]::GetTempPath()) "$date_time_stamp-puppet-install.log"
107107

108+
# Most modern sites either require or are starting to require TLS 1.2.
109+
# On older Windows systems the default security protocols for PowerShell 5 are SSL3 and TLS 1.0.
110+
# When communicating with a site that has a higher TLS requirement requests will fail with the following error:
111+
# `Could not create SSL/TLS secure channel`.`
112+
# Set-Tls12 will add TLS 1.2 to the list of available security protocols if it is not already present.
113+
function Set-Tls12 {
114+
$Tls12 = [System.Net.SecurityProtocolType]::Tls12
115+
$CurrentSecurityProtocolList = [System.Net.ServicePointManager]::SecurityProtocol
116+
if (!$CurrentSecurityProtocolList.HasFlag($Tls12)) {
117+
[System.Net.ServicePointManager]::SecurityProtocol = $CurrentSecurityProtocolList, [System.Net.SecurityProtocolType]::Tls12
118+
}
119+
}
120+
108121
function DownloadPuppet {
109122
Write-Output "Downloading the Puppet Agent installer on $env:COMPUTERNAME..."
123+
Set-Tls12
124+
110125
$webclient = New-Object system.net.webclient
111126

112127
try {

0 commit comments

Comments
 (0)