René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Add User Supplied ServerCertificateCustomValidationCallback Support to Web Cmdlets","articleBody":"# Problem\r\n\r\nCurrently users only have 2 options for dealing with Server SSL/TLS Certificates with `Invoke-WebRequest` and `Invoke-RestMethod`: the default validation and to skip validation. Some scenarios warrant tighter security on web requests where a certificate is not fully trusted by the host environment but is known to be trusted by the user. This could include internal web APIs that use a self signed certificate with a specific thumbprint or from a known CA that is not trusted by the host. Or if a user wishes to ensure a certain CA/Thumbprint/Subject is blocked (a known bad actor).\r\n\r\nAlso `[System.Net.ServicePointManager]::ServerCertificateValidationCallback` has no effect in Core and `HttpClient` only uses the settings provided by `HttpClientHandler`.\r\n\r\n# Proposal\r\n\r\nAdd a parameter of type `Func\u003cHttpRequestMessage,X509Certificate2,X509Chain,SslPolicyErrors,Boolean\u003e` that accepts a ScriptBlock to both Web Cmdlets. This is to be set on `HttpClientHandler.ServerCertificateCustomValidationCallback`. The `-SkipCertificateCheck` would have priority, meaning if both were supplied either a parameter exception is thrown or `-SkipCertificateCheck` would be applied and the callback ignored. \r\n\r\nThe Parameter will be named `CertificateValidationScript`\r\n\r\n# For consideration\r\n\r\n* What to name this parameter?\r\n* Throw or no throw on clash with `-SkipCertificateCheck`?","author":{"url":"https://github.com/markekraus","@type":"Person","name":"markekraus"},"datePublished":"2017-09-22T17:47:13.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":48},"url":"https://github.com/4899/PowerShell/issues/4899"}