Windows installation fails with "The request was aborted: Could not create SSL/TLS secure channel."

[svdHero]

System

• Version: 12.16.3
• Platform: Windows 8.1
• .NET Versions installed: 4.5.1 , 4.6.1, 4.7.2, Core 2.2, Core 3.1

What steps will reproduce the bug?

1. Download latest Nodejs LTS version here : https://nodejs.org/dist/v12.16.3/node-v12.16.3-x64.msi
2. Install the msi
3. Choose the option to install additional tools
4. Confirm the execution of the installation script
5. Wait until installation fails

How often does it reproduce? Is there a required condition?

Always fails. No condition required.

What is the expected behavior?

Installation just works and finishes without errors.

What do you see instead?

The error message:

Exception calling "DownloadString" with "1" argument(s): "The request was aborted: Could not create SSL/TLS secure channel."
At line:1 char:1
+ iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/in ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : WebException

Additional information

This seems to be well-known with Chocolatey clients:
https://chocolatey.org/docs/troubleshooting#the-request-was-aborted-could-not-create-ssltls-secure-channel
which has recently removed support for older TLS versions, see:
https://chocolatey.org/blog/remove-support-for-old-tls-versions

My computer does support TLS 1.2 and the Powershell command

[Enum]::GetNames([Net.SecurityProtocolType]) -contains 'Tls12'

returns True.

I have also created a file C:\Users\<myusername>\Documents\PowerShell\Profile.ps1 with content

[Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"

but that did not change anything. The installation still fails.

What can I do to install nodejs with its additional tools?
Can you update your installation scripts, please?

[bnoordhuis]

Can you update your installation scripts, please?

I don't know if there's anything the install script could do differently except maybe try a newer powershell version? I'm not sure if that'd make a difference but perhaps you can try it.

This is the relevant line:

node/tools/msvs/install_tools/install_tools.bat

Line 55 in 2cd7970

"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command Start-Process '%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe' -ArgumentList '-NoProfile -InputFormat None -ExecutionPolicy Bypass -Command iex ((New-Object System.Net.WebClient).DownloadString(''https://chocolatey.org/install.ps1'')); choco upgrade -y python visualstudio2017-workload-vctools; Read-Host ''Type ENTER to exit'' ' -Verb RunAs

[svdHero]

@bnoordhuis Awesome. That did the trick! I installed the latest Powershell release from https://github.com/PowerShell/PowerShell/releases/tag/v7.0.0 and replaced

%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe

by

C:\Program Files\PowerShell\7\pwsh.exe

in the batch file you mentioned. The installation worked fine now!

Would it be worth replacing the default "v1.0" in the batch file by something newer?

Maybe try to find the system's latest Powershell installation? Or rely on the Powershell installation to modify the PATH environment variable such that you could omit the directory altogether? At least the installation of the latest version asked if I wanted it to be added to PATH.

[bnoordhuis]

I think we're open to such changes. I don't use Windows myself so I can't really evaluate the impact but if you open a PR for people to chime in, we'll take it from there.

[bzoz]

FWIW, thev1.0 in the path is not the version, it is there probably because of historical reasons:

C:\>c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Try the new cross-platform PowerShell https://aka.ms/pscore6

PS C:\> $PSVersionTable.PSVersion

Major  Minor  Build  Revision
-----  -----  -----  --------
5      1      18362  752

[svdHero]

Ah thanks. I have never used Powershell before and I have very little experience with batch scripts. Thus, it would be difficult for me to open a PR.
Maybe someone else is more skilled in Powershell?

[jschpp]

The Change shouldn't be that big... You'd only need to change the one line mentioned by @bnoordhuis
It would then look like this:

"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command Start-Process '%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe' -ArgumentList '-NoProfile -InputFormat None -ExecutionPolicy Bypass -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString(''https://chocolatey.org/install.ps1'')); choco upgrade -y python visualstudio2017-workload-vctools; Read-Host ''Type ENTER to exit'' ' -Verb RunAs 

If you want I can submit a PR for that

[neogic]

This is a general PowerShell issue, replicated on PS v1 and v5 on Windows 7 (with Node.js v13.6). Solution (from here: https://stackoverflow.com/a/62389502) is to enable TLS 1.2 as supported protocol (which is separate from it being supported) by running in admin PS:
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12

In my case I also had to manually run the command instead of using the batch file:
iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')); choco upgrade -y python2 visualstudio2017-workload-vctools

[jschpp]

@neogic Was this reintroduced? As far as I can tell this should've been closed since my pull request was merged and backported.

[neogic]

@jschpp I saw with a recently installed version of Node (v13.6) - though not the latest (v14.17.x) because I think I ran into an issue with NPM on Win 7.

At the core it's pretty definitely a PowerShell TLS/SSL config issue - I reproduced by running just (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') in a PowerShell prompt. Though I'm surprised the batch file didn't work once the config issue was resolved and I had to run the above command manually.

[jschpp]

@neogic yup. You're right the 13.x branch is missing the PR. Thats curious.

pinging @bzoz Would you backport the PR to 13.x or should a new PR be opened about it?