Azure DevOps Agent running on https failed with TLS 1.2 Issue

[DalpheSDC]

Hi
Task TFVC - Check-in changes (Preview)

Version 2.25
When running on a agent using https to connect our on-premise instance behind a proxy. is failes with
"TF400324: Azure DevOps services are not available from server https://...-...--/tfs
Technical information (for administrator):
Anmodningen blev afslået: Der kunne ikke etableres en sikker kanal til SSL/TLS."
translate it can't established SSL/TLS save channel.
This is cause by missing upset of TLS 1.2 in the script

when I'm running this on the agent with port 8080 without SSL it work fine.
Sorry that i didn't give you feedback on the last issue I created, but had to much to do at work.

Regards
Peter

[jessehouwing]

What OS version? What Powershell version? What .NET version? On the agent? Is the cert trusted and does the hostname match and all?

…

On Thu, 19 Dec 2019, 14:34 DalpheSDC, ***@***.***> wrote: Hi Task TFVC - Check-in changes (Preview)  Version 2.25 When running on a agent using https to connect our on-premise instance behind a proxy. is failes with "TF400324: Azure DevOps services are not available from server https:// ...-...--/tfs Technical information (for administrator): Anmodningen blev afslået: Der kunne ikke etableres en sikker kanal til SSL/TLS." translate it can't established SSL/TLS save channel. This is cause by missing upset of TLS 1.2 in the script when I'm running this on the agent with port 8080 without SSL it work fine. Sorry that i didn't give you feedback on the last issue I created, but had to much to do at work. Regards Peter — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#91?email_source=notifications&email_token=AA724SYGFPOGXITOHYILZG3QZNZ6RA5CNFSM4J5GMKAKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4IBUS24Q>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA724S7XQ76RTYINATGIERDQZNZ6RANCNFSM4J5GMKAA> .

[DalpheSDC]

Windows 10 and Windows 2012 R2,
.NET 4.7.2

Powershell
Major Minor Build Revision

---

5 1 17134 858

normallye this is the line missing in the PowerShell
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;
There is a Cert trusted amd the hostname match it.
##[debug]Agent.ProxyUrl=http://...
##[debug]Agent.CAInfo=C:\TFS\A2\sdcca.pem
##[debug]Agent.ClientCert=undefined
##[debug]expose agent certificate configuration.
##[debug]Agent.SkipCertValidation=undefined
##[debug]Agent.ProxyUrl=http://...
##[debug]Agent.CAInfo=C:\TFS\A2\sdcca.pem
##[debug]Agent.ClientCert=undefined

Hope this give you some ideas.

[jessehouwing]

If the agent is correctly configured, TLS 1.2 should be fixed up from the systems protocol configuration. I am aware I can set the protocol suite manually, but what should I set it to? If people host on TFS 2015 they may not have this option. Please check https://johnlouros.com/blog/enabling-strong-cryptography-for-all-dot-net-applications

…

On Fri, 20 Dec 2019, 10:35 DalpheSDC, ***@***.***> wrote: Windows 10 and Windows 2012 R2, .NET 4.7.2 Powershell Major Minor Build Revision ------------------------------ 5 1 17134 858 normallye this is the line missing in the PowerShell [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; There is a Cert trusted amd the hostname match it. ##[debug]Agent.ProxyUrl=http://... ##[debug]Agent.CAInfo=C:\TFS\A2\sdcca.pem ##[debug]Agent.ClientCert=undefined ##[debug]expose agent certificate configuration. ##[debug]Agent.SkipCertValidation=undefined ##[debug]Agent.ProxyUrl=http://... ##[debug]Agent.CAInfo=C:\TFS\A2\sdcca.pem ##[debug]Agent.ClientCert=undefined Hope this give you some ideas. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#91?email_source=notifications&email_token=AA724S5YU5JK3DAOHSA6D3LQZSGVHA5CNFSM4J5GMKAKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEHMNPEI#issuecomment-567859089>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA724S772HNRTUVA7T6CQCDQZSGVHANCNFSM4J5GMKAA> .

[jessehouwing]

Fixed in: 2.2.6

[DalpheSDC]

I can confirm that it works perfect. thank you