Seb's IT blog

Force PowerShell to use newer TLS versions

  • May 09, 2020

The PowerShell Gallery has deprecated Transport Layer Security (TLS) versions 1.0 and 1.1 as of April 2020 for security reasons causing an incompatibility with module Cmdlets:

PS C:\WINDOWS\system32> Install-Module -Name PSEventViewer -Scope User -Force
WARNING: Source Location ‘https://www.powershellgallery.com/api/v2/package/PSEventViewer/1.0.13' is not valid.
PackageManagement\Install-Package : Package ‘PSEventViewer' failed to download.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1772 char:21
+ ...          $null = PackageManagement\Install-Package @PSBoundParameters
+                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (C:\Users\adm_jz…entViewer.nupkg:String) [Install-Package], Exception
    + FullyQualifiedErrorId : PackageFailedInstallOrDownload,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

To work around this run:

[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
Install-Module PowerShellGet -RequiredVersion 2.2.4 -SkipPublisherCheck

It should be noted this only affects legacy PowerShell 5.1 and earlier. PowerShell 6-7 don’t utilize System.Net.ServicePointManager under the hood anymore and the replacement libraries it does use all default to having TLS1.2 enabled as far as I’ve tested. Web cmdlets like Invoke-RestMethod and Invoke-WebRequest also have dedicated parameters like -SslProtocol and -SkipCertificateCheck so you don’t have to resort to old hacky workarounds for things like disabling cert validation.

To force all processes targeting .NET 4.5 (including PowerShell) to use newer TLS versions and disable older versions, run:

Set-ItemProperty `
    -Path "HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319" `
    -Name "SchUseStrongCrypto" `
    -Value "1" `
    -Type DWord `
    -Force

Set-ItemProperty `
    -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v4.0.30319" `
    -Name "SchUseStrongCrypto" `
    -Value "1" `
    -Type DWord `

References:

Search