SSL connection could not be established - install/update workaround

[luxzg]

Hey all,

I've encountered an issue with PowerShell and some HTTPS sites, in this case https://windows.php.net

Issue details:

• file can't be downloaded using scoop or PowerShell
• same file, same PC, same user, downloads from browser work
• scoop install in PS Core 7.5.0 errors with: The SSL connection could not be established, see inner exception. URL https://windows.php.net/downloads/releases/php-8.4.5-Win32-vs17-x64.zip is not valid
• scoop install on PS 5.1 errors with: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. URL https://windows.php.net/downloads/releases/php-8.3.19-Win32-vs16-x64.zip is not valid
• curl in same PS session returns errors schannel: disabled automatic use of client certificate & schannel: failed to receive handshake, SSL/TLS connection failed
• Invoke-WebRequest returns error : Invoke-WebRequest: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host..

... and so on ...

While not an issue with scoop, relying on PowerShell makes it an issue anyway.

Note that at the same time updating 30+ apps with scoop went just fine, it's just some websites that have this issue.

I found similar issues on github for scoop install failures, such as:

• tortoisesvn@1.14.9.29743: not able to download Extras#14733
• [Bug]: DBeaver@24.0.2 URL is not valid Extras#13127
• [Bug] The SSL connection could not be established, see inner exception. #6183
• [Bug]: qbittorrent (5.0.2 -> 5.0.3) error - The handshake failed due to an unexpected packet format. Extras#14660

Proposed workarounds sometimes revolve around variations on:
[Net.ServicePointManager]::SecurityProtocol = "tls, tls11, tls12, tls13, SystemDefault"

I tried variations like:
[Net.ServicePointManager]::SecurityProtocol = "tls13, tls12, tls11"
... and so on.. nothing helped
Note this is per-session setting, so even if you change it, close PS window, and reopen new one, running [System.Net.ServicePointManager]::SecurityProtocol will confirm your settings were reset. So answers where they had success after reboot don't make sense either,
Also, enabling or disabling aria in scoop didn't help either way.

Anyway, long story short, I did NOT resolve the downloading issue, so if anyone has other workarounds please chime in.

But I DID make another workaround, though slightly silly as scoop was meant to automate things, but anyway...

• download file manually through browser, using same URL that scoop error returns
• open scoop cache folder, eg C:\scoop\cache
• I was lucky so I had old versions in it as a sample, files are renamed, and here is a sample few for PHP:

php#8.2.6#https_windows.php.net_downloads_releases_php-8.2.6-Win32-vs16-x64
php#8.2.12#https_windows.php.net_downloads_releases_php-8.2.12-Win32-vs16-x64
php#8.3.1#https_windows.php.net_downloads_releases_php-8.3.1-Win32-vs16-x64

• carefully look at whole URL you used to download file, in my case it was
  https://windows.php.net/downloads/releases/php-8.4.5-Win32-vs17-x64.zip
• now copy your manually downloaded file into cache folder and rename it accordingly, in my case to:
  php#8.4.5#https_windows.php.net_downloads_releases_php-8.4.5-Win32-vs17-x64.zip
• just in case it isn't clear enough, syntax is:

<package>    php
<hash>       #
<version>    8.4.5
<hash>       #
<url>        https_windows.php.net_downloads_releases_php-8.4.5-Win32-vs17-x64.zip
# obviously using "_" underscore instead illegal file/path characters ":" and "/" throughout the URL to filename conversion

• run scoop install command, eg scoop install main/php
• install should progress fine now, using "cached" file and resulting in success such as:
  'php' (8.4.5) was installed successfully!

Same should work in case your update fails, download and place new file to cache then try to update again.

Now, my GUESS is based on curl error, that php.net requires client certificate and PowerShell isn't providing any, or is providing wrong file. I have no idea how to solve that. Invoke-Webrequest can serve certificate but I didn't bother as I still wouldn't be able to make scoop do the same.

Anyway, there's my workaround for similar issues, if someone knows how to solve underlying issue, I'd be happy to have something more... permanent... ;-)