8000 Invoke-RestMethod and Invoke-WebRequest don't support client certificate authentication with certificate files · Issue #4544 · PowerShell/PowerShell · GitHub
[go: up one dir, main page]
Skip to content

Invoke-RestMethod and Invoke-WebRequest don't support client certificate authentication with certificate files #4544

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
Karneades opened this issue Aug 10, 2017 · 8 comments
Closed

Invoke-RestMethod and Invoke-WebRequest don't support client certificate authentication with certificate files #4544

Karneades opened this issue Aug 10, 2017 · 8 comments
Labels
Issue-Discussion the issue may not have a clear classification yet. The issue may generate an RFC or may be reclassif Resolution-Fixed The issue is fixed. WG-Cmdlets-Utility cmdlets in the Microsoft.PowerShell.Utility module

Comments

@Karneades
Copy link

Invoke-RestMethod and Invoke-WebRequest requires the certificate specified by -Certificate to be imported in the certificate store. Both methods do not allow using certificates from files. This breaks client certificate authentication on non-Windows platforms.

Proposal: Support the use of certificate files for the client authentication by adding a new parameter -CertificateFile or by using the x509 object from Get-PfxCertificate directly.

This was tested on Ubuntu 16.04 with PowerShell 6.0.0-beta.5 and on Windows with PowerShell 5.0.

Ref: #473 and #1865
@Karneades Karneades mentioned this issue Aug 10, 2017
Closed
@markekraus
Copy link
Contributor

Just verifying. When this is attempted with Get-PfxCertificate the .pfx file that is imported included the both the private key and certificate?

@Karneades
Copy link
Author
Karneades commented Aug 10, 2017 via email •
edited
Loading

@iSazonov iSazonov added WG-Cmdlets-Utility cmdlets in the Microsoft.PowerShell.Utility module Issue-Discussion the issue may not have a clear classification yet. The issue may generate an RFC or may be reclassif labels Aug 10, 2017
@markekraus
Copy link
Contributor

Ok. I see a TODO in WebRequestPSCmdlet.CoreClr.cs to add this after it was made available in CoreFX. I see that it is now available in CoreFX and I have working build on Linux with the changes implemented. Now I just need to figure out how to add tests for it. It's not exactly a -CertificateFile but it does work with Get-PfxCertificate.

@Karneades
Copy link
Author

I was able to use a certificate on Windows without having the cert imported in the cert store. BUT the exact same command on Ubuntu fails. The certificate is valid and used within the browser but is not working with Invoke-RestMethod ... -Certificate (Get-PfxCertificate...).

Could someone confirm having the same issues on Linux/Ubuntu with a valid certificate? Otherwise its probably no PowerShell issue at all.

@markekraus
Copy link
Contributor

@Karneades Yes, it is currently not possible in 6.0.0-beta.5 on Linux.

I was saying that I was able to locate the issue in the source code and implement code changes to make it work. I'm working on everything that is needed to make a proper Pull Request. This will likely be available in future versions (whether it is from my pull request or some other work).

@markekraus markekraus mentioned this issue Aug 10, 2017
Merged
@Karneades
Copy link
Author
Karneades commented Aug 10, 2017 via email

@markekraus
Copy link
Contributor

@Karneades No problem! If you want. you can clone from my fork, build it and test it.

mkdir ~/gittest
cd ~/gittest/
git clone --recursive https://github.com/markekraus/PowerShell.git
cd PowerShell/
git checkout WebClientCerts
git remote add upstream https://github.com/powershell/powershell.git
powershell -noprofile -ExecutionPolicy bypass -command 'Import-Module ./build.psm1; Sync-PSTags; Start-PSBootstrap; Start-PSBuild'

The last line of output will give you the binary path of the newly built powershell. Run that and then try to use Get-PfxCertificate with Invoke-RestMethod and Invoke-WebRequest. My simple tests work, but I don't have anything outside an echo server to test real Certificate Authentication with.

@Karneades
Copy link
Author

Awesome! What a nice small change to make that important feature work! Tested successfully both on Windows 10 and Ubuntu 16.04 with your fork. Hope your PR will make it into the next beta. Thanks so much!

markekraus added a commit to markekraus/PowerShell that referenced this issue Aug 17, 2017
@markekraus
[Feature] Add Certificate Authentication Support for WebCmdlets
52a7ff5 
PowerShell#4544
adityapatwardhan pushed a commit that referenced this issue Aug 18, 2017
@markekraus @adityapatwardhan
[Feature] Add Certificate Authentication Support for WebCmdlets (#4546)
1b23a62 
* [Feature] Add Certificate Authentication Support for WebCmdlets

#4544

* Add Certificate  Comments

* Set Certificate Options

* [feature] Post-rebase White-space correction

* [feature] mark certauth tests pending
@iSazonov iSazonov added the Resolution-Fixed The issue is fixed. label Sep 4, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Issue-Discussion the issue may not have a clear classification yet. The issue may generate an RFC or may be reclassif Resolution-Fixed The issue is fixed. WG-Cmdlets-Utility cmdlets in the Microsoft.PowerShell.Utility module
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@markekraus @iSazonov @Karneades
0