PR Summary

Only require -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck) on non-Windows hosts when the client OMI library does not support cert verification.

PR Context

The version of psrpclient and mi that are shipped with PowerShell on non-Windows hosts do not support certificate verification. Because of this limitation if you try to connect over a HTTPS WSMan listener with just -UseSSL PowerShell will fail with

Invoke-Command: HTTPS on Unix does not currently support CA or CN checks. Use the PSSessionOption -SkipCACheck and -SkipCNCheck if you are certain you trust the server you are connecting to and the network in between.

This is a perfectly adequate method to ensure end users are aware no cert verification is happening. In the meantime I have a fork of both psrpclient and mi that are designed to fix some of the bugs and limitations that face WSMan users on non-Windows clients and one of those fixes is to add certificate verification for WSMan. The current fork is set to always do certificate verification regardless of the session options for 2 reasons

• The session options right now are not based down from PowerShell to psrpclient to mi
  • First reason for this is the hardcoded check but even without that, the build of psrpclient that is shipped by PowerShell does nothing when it's told to set those options
• Without a way to get PowerShell to tell mi that cert verification is off or on, I decided to use env vars to control the behaviour and have verification on by default
  • If a user wants to disable verification they need to set the proper env vars
  • Unfortunately they still need SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck) in PowerShell due to the hardcoded check

What I'm proposing is to relax that check to only fail if the underlying psrpclient library does not support passing those options along. That way people using the libs shipped by PowerShell continue to work as usual but people who use my forked copy of psrpclient and mi will be able to omit the options and only add them if they truly want to disable cert verification. This check in PowerShell is simple, it will call WSManGetSessionOptionAsDword with the WSMAN_OPTION_SKIP_CA_CHECK option. The current build of psrpclient shipped by PowerShell will return MI_RESULT_NOT_SUPPORTED for options that aren't implemented (this being one of them) whereas my fork will return MI_RESULT_OK to state the option was available. By checking that value we can see if the underlying libs support verification and control whether PowerShell displays the error message or not.

The underlying changes required to psrpclient and mi are currently in this PR jborean93/omi#15. I still need to do some more testing but so far they seem to work as desired.

More background can be found here #13577.

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
• This PR is ready to merge and is not Work in Progress.
  • If the PR is work in progress, please add the prefix WIP: or [ WIP ] to the beginning of the title (the WIP bot will keep its status check at Pending while the prefix is present) and remove the prefix when the PR is ready.
• Breaking changes
  • None
  • OR
  • Experimental feature(s) needed
    • Experimental feature name(s):
• User-facing changes
  • Not Applicable
  • OR
  • Documentation needed
    • Issue filed:
• Testing - New and feature
  • N/A or can only be tested interactively
  • OR
  • Make sure you've added a new test if existing tests do not effectively test the code changed
• Tooling
  • I have considered the user experience from a tooling perspective and don't believe tooling will be impacted.
  • OR
  • I have considered the user experience from a tooling perspective and enumerated concerns in the summary. This may include:
    • Impact on PowerShell Editor Services which is used in the PowerShell extension for VSCode (which runs in a different PS Host).
    • Impact on Completions (both in the console and in editors) - one of PowerShell's most powerful features.
    • Impact on PSScriptAnalyzer (which provides linting & formatting in the editor extensions).
    • Impact on EditorSyntax (which provides syntax highlighting with in VSCode, GitHub, and many other editors).