Support TLS 1.2 - "Could not create SSL/TLS secure channel"

[crazy4cs]

• set-executionpolicy remotesigned -s currentuser has been ran
• PowerShell 3 or greater is installed

PS C:\WINDOWS\system32> $PSVersionTable.PSVersion
Major  Minor  Build  Revision
-----  -----  -----  --------
5      1      16299  248

iex : Exception calling "DownloadFile" with "2" argument(s): "The request was aborted: Could not create SSL/TLS secure
channel."
At line:1 char:1
+ iex (new-object net.webclient).downloadstring('https://get.scoop.sh')
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Invoke-Expression], MethodInvocationException
    + FullyQualifiedErrorId : WebException,Microsoft.PowerShell.Commands.InvokeExpressionCommand

The scoop directory is created within the user profile folder, as well as the %USERPROFILE%\scoop\apps\scoop\current directory, however, they are both empty.

[hss-dev]

My colleague has just tried to install Scoop and also got this problem. I installed it last week and it was fine.

[r15ch13]

What's the output of Get-ExecutionPolicy -List?

[hss-dev]

My colleagues settings were

   Scope ExecutionPolicy
   ----- ---------------

MachinePolicy Undefined
UserPolicy Undefined
Process Undefined
CurrentUser RemoteSigned
LocalMachine RemoteSigned

Hello I'm having the same issue

[r15ch13]

Whats the output of [Net.ServicePointManager]::SecurityProtocol?

PS C:\Users\chere> [Net.ServicePointManager]::SecurityProtocol Ssl3, Tls PS C:\Users\chere>

And if I try to install it again it says:

PS C:\Users\chere> iex (new-object net.webclient).downloadstring('https://get.scoop.sh')
Initializing...
Scoop is already installed. Run 'scoop update' to get the latest version.
PS C:\Users\chere> scoop update
scoop : The term 'scoop' is not recognized as the name of a cmdlet, function, script file, or operable program. Check
the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1

• scoop update

• + CategoryInfo          : ObjectNotFound: (scoop:String) [], ParentContainsErrorRecordException
  

• FullyQualifiedErrorId : CommandNotFoundException

PS C:\Users\chere>

[covertcj]

I just ran into this as well on a 'fresh' install of Windows 10 (it was installed from a base image provided by the IT dept, for whatever that's worth). I found that I was able to delete the ~/scoop directory, run the command:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

directly in my prompt, and then re-install with the standard method. That being said, it seems I need to re-run that command in each new powershell window, or I see a bunch of SSL/TLS errors any time I use scoop.

[masaeedu]

You can put [Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls" in your Powershell profile (notepad $PROFILE) as a workaround. It seems like something's changed on github's side so they no longer accept TLSv1, which winhttp uses by default. There's also stuff you can fiddle with in the registry to get winhttp to use TLSv1.2 instead.

EDIT: Looks like installing .NET 4.6.1 also changes the default TLS scheme to 1.2.

[tresf]

Just updated Windows 10 today and I'm receiving this. I've tried the above suggestions without much luck, although the symptoms are the same, my error is a bit different.

PS C:\Users\Tres> scoop update
Updating Scoop...
fatal: unable to access 'https://github.com/lukesampson/scoop/': error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version
Update failed.

I've tried setting the registry flag to force WinHttp to a higher TLS version, but it's not working on my machine or perhaps my steps are incorrect.

The suggestion to use notepad $PROFILE doesn't seem to work on my installation, I'm not sure what that does. My scoop version is ef058e9 Update fnproject to version 0.4.34.

[masaeedu]

@tresf notepad $PROFILE doesn't do anything by itself, it's just supposed to open your Powershell profile file for editing. In that file you need to add [Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls". Before adding it to your profile file, you can test out whether the incorrect TLS version is causing your issue by just running this command in a powershell session right before scoop update.

[tresf]

you can test out whether the incorrect TLS version is causing your issue by just running this command in a powershell session right before scoop update.

I wasn't able to get either proposal to help...

• [Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"
• [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

I also removed ~/scoop and reinstalled through the iex ... command from scoop.sh, which worked, but once scoop update was run, the tlsv1 alert protocol version error comes back.

@tresf notepad $PROFILE doesn't do anything by itself, it's just supposed to open your Powershell profile file for editing.

Thanks for explaining. The command didn't work on my machine. I'm happy to know it's the same effect as setting the properties via PowerShell command line, so I won't worry about it at this time.

[tresf]

PS C:\Users\Tres> scoop update
Updating Scoop...
fatal: unable to access 'https://github.com/lukesampson/scoop/': error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version
Update failed.

Apologies... My issue was a botched git-scm after the Windows 10 updates. The fix was to completely purge all git versions and reinstall. Interestingly enough, the default git location changed from C:\Program Files (x86)\ to C:\Program Files\ but my system did not reflect it, so this seems to be unrelated to the original bug report and fixed by repairing git through some manual steps. The symptoms and timing were very close to the original bug report, so I thought they were related, but they appear to be different.

[jordanbtucker]

@masaeedu Is there a work around for this when using the command prompt? Having to use scoop exclusively in PowerShell is inconvenient.

[r15ch13]

Scoop has the following functions to enable every available protocol when downloading apps:
https://github.com/lukesampson/scoop/blob/f8f08db7e53f624b4c81f5d61e8d16c8176a13a7/lib/install.ps1#L117-L133

Currently they are only used in do_dl(), checkver.ps1 and checkurls.ps1
https://github.com/lukesampson/scoop/blob/f8f08db7e53f624b4c81f5d61e8d16c8176a13a7/lib/install.ps1#L135-L149

Adding them to all other commands that require downloading something could fix it.
It has to be set manually for the initial scoop installation to work.