Support SPP 9.0 TLS 1.3: pin HTTP/1.1 and add TLS version range (#650) - #653
Draft
DanPeterson wants to merge 2 commits into
Draft
Support SPP 9.0 TLS 1.3: pin HTTP/1.1 and add TLS version range (#650)#653DanPeterson wants to merge 2 commits into
DanPeterson wants to merge 2 commits into
Conversation
SPP 9.0 enables TLS 1.3 and exposes an HTTP/2-capable binding. HTTP/2 disallows the post-handshake certificate request that client-certificate authentication depends on, so all Safeguard REST calls -- including the A2A certificate callers in a2acallers.psm1 -- are pinned to HTTP/1.1. Connect-Safeguard and Invoke-SafeguardMethod gain optional -MinimumTlsVersion and -MaximumTlsVersion (1.2 or 1.3) to constrain the negotiated TLS version and fail closed outside the range. The setting is persisted in the session and inherited by later Invoke-SafeguardMethod calls. On PowerShell 7 the range is applied per request via -SslProtocol; on Windows PowerShell 5.1 it is applied process-wide via ServicePointManager. Bumps the base version to 8.5.0.
DanPeterson
force-pushed
the
danpeterson-tls13-http1-support
branch
from
August 14, 2026 01:06
99b266e to
c9abf96
Compare
Connect-Safeguard always stores MinimumTlsVersion/MaximumTlsVersion in the
session hashtable, and both are empty when a connection is made without
explicit TLS pins (the default). Invoke-SafeguardMethod then inherited those
empty values into its own [ValidateSet("1.2","1.3")][string] parameters,
which throws "'' is not a valid value for the MinimumTlsVersion variable"
at assignment time. Because virtually every cmdlet routes through
Invoke-SafeguardMethod, this broke the module for any session that did not
pin a TLS version.
Guard both inheritance assignments so a value is only pulled from the
session when it is actually set, matching the existing IsNullOrEmpty guard
used before forwarding the bounds to a nested Connect-Safeguard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #650.
Summary
SPP 9.0 enables TLS 1.3 and exposes an HTTP/2-capable binding. HTTP/2 disallows the post-handshake certificate request that client-certificate authentication depends on, so this pins HTTP/1.1 on all Safeguard REST calls, and adds an optional TLS version range for callers who want to constrain negotiation.
Changes
a2acallers.psm1(pure client-cert auth — the case most likely to break on 9.0's HTTP/2 binding). Applied via-HttpVersion 1.1where available (PowerShell 7.3+); older PS7 and Windows PowerShell 5.1 already default to HTTP/1.1.-MinimumTlsVersion/-MaximumTlsVersion(1.2or1.3) onConnect-SafeguardandInvoke-SafeguardMethod:-MinimumTlsVersion 1.3requires TLS 1.3, failing closed below it.-MaximumTlsVersion 1.2pins to TLS 1.2 as an interim measure.Invoke-SafeguardMethodcalls.-SslProtocol; Windows PowerShell 5.1 applies it process-wide viaServicePointManager. Only TLS 1.2/1.3 are ever enabled (1.0/1.1 remain excluded).pipeline-templates/global-variables.yml+src/safeguard-ps.psd1, keeping the.99999placeholder).Validation
./Invoke-PsLint.ps1 -Strictclean (src + test)ValidateSet1.2/1.3Strips Tls10/Tls11failures are unrelated and untouched)Testing still needed (draft)
-MinimumTlsVersion 1.3, and-MaximumTlsVersion 1.2