diff --git a/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs b/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs index 1b1fe2b2163..b46c13b5ea0 100644 --- a/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs +++ b/src/System.Management.Automation/engine/remoting/fanin/WSManNativeAPI.cs @@ -2443,9 +2443,9 @@ internal static extern int WSManSetSessionOption(IntPtr wsManSessionHandle, /// /// An int (DWORD) data. /// - /// + /// Zero on success, otherwise the error code. [DllImport(WSManNativeApi.WSManClientApiDll, SetLastError = false, CharSet = CharSet.Unicode)] - internal static extern void WSManGetSessionOptionAsDword(IntPtr wsManSessionHandle, + internal static extern int WSManGetSessionOptionAsDword(IntPtr wsManSessionHandle, WSManSessionOption option, out int value); diff --git a/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs b/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs index 1fad7ccb3e8..9be3d79a9e3 100644 --- a/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs +++ b/src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs @@ -1546,8 +1546,13 @@ private void Initialize(Uri connectionUri, WSManConnectionInfo connectionInfo) throw new PSRemotingTransportException(PSRemotingErrorId.ConnectFailed, RemotingErrorIdStrings.BasicAuthOverHttpNotSupported); } - // Allow HTTPS on Unix only if SkipCACheck and SkipCNCheck are selected, because OMI client does not support validating server certificates. - if (isSSLSpecified && (!connectionInfo.SkipCACheck || !connectionInfo.SkipCNCheck)) + // The OMI client distributed with PowerShell does not support validating server certificates on Unix. + // Check if third-party psrpclient and MI support the verification. + // If WSManGetSessionOptionAsDword does not return 0 then it's not supported. + bool verificationAvailable = WSManNativeApi.WSManGetSessionOptionAsDword(_wsManSessionHandle, + WSManNativeApi.WSManSessionOption.WSMAN_OPTION_SKIP_CA_CHECK, out _) == 0; + + if (isSSLSpecified && !verificationAvailable && (!connectionInfo.SkipCACheck || !connectionInfo.SkipCNCheck)) { throw new PSRemotingTransportException(PSRemotingErrorId.ConnectSkipCheckFailed, RemotingErrorIdStrings.UnixOnlyHttpsWithoutSkipCACheckNotSupported); }