PowerShell 7 cannot connect with AcceptSelfSignedCert parameter

[Raphi]

Hello,

I am using Powershell 7.4.1 and vPro Module version 16.7.0.1. I cannot connect to TLS enabled hosts with the -AcceptSelfSignedCert parameter. The hosts have thh Intel® AMT self-signed certificate installed. With non TLS clients it works without any problem.

When I run following command with PowerShell 5.1 it works.

Invoke-AMTPowerManagement $hostFQDN -Credential $vproCredential -Operation PowerOn -TLS -AcceptSelfSignedCert

With PowerShell 7.4.1 I am getting following error on the same command:

"The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch, RemoteCertificateChainErrors"

The error appears on line 116 in file Get-AMTPowerState.ps1

$AssociatedObj = $ObjRef.Get()

I could not find out how to get this working on my own. What do I need to do to get the connection working with the parameter -AcceptSelfSignedCert 

Is there mybe any Option missing in the WsmanConnection Object in Get-AMTPowerState.ps1?

I tried setting the Option VerifyCertificates to false but sadly the same error appears.

$Connection.Options.VerifyCertificates = $false;

Thanks in advance for your help!

Greets Raphi

[MIGUEL_C_Intel]

Hello, Raphi,

Thank you for using Intel vPro support services.

Please allow us time to review your case, we will in a timely manner.

[Raphi]

Hello,

thanks for your reply. I have posted the wrong command I have used this command in my debug example above:
Get-AMTPowerState -computername $hostFQDN -Credential $vproCredential -TLS -AcceptSelfSignedCert

But it doesn't make a difference the certificate error appears on all commands.

Hope there will be a fix for this soon.

Greets Raphael

[Raphi]

Update: I have tested with the newly released IntelVproModule 18.0.0.1

https://www.intel.com/content/www/us/en/download/704395/intel-vpro-technology-module-for-windows-powershell.html

Get-AMTPowerState -computername $hostFQDN -Credential $vproCredential -TLS -AcceptSelfSignedCert

Now this error appears - the RemoteCertificateChainErrors seems to be gone in this version:

The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch

[MIGUEL_C_Intel]

Hello, Raphael,

I hope this message finds you well.

After reviewing the case with our development team, I confirm that Power Shell 7.x is not supported or validated.  More details in section 2.1 Requirements of the Intel vPro® Technology Module for Microsoft* Windows* PowerShell* Installation and User Guide included in the software zip package.

https://www.intel.com/content/www/us/en/download/704395/intel-vpro-technology-module-for-windows-powershell.html

Requirements: Windows PowerShell versions up to including version 5.1.

There is no date available for newer software updates yet. I was not able to confirm if Power Shell 7.x will be supported in the future.

Regards,

Miguel C.

Intel Customer Support Technician

[Raphi]

Hello Miguel,

sad to hear that. Is there any possibility to get an update when there is a new version with PowerShell 7 support? Maybe you can add a new comment to this post?

We would also be happy to test a beta release. I think this could be only a small issue in the compiled .NET library the module uses. Maybe there is some new parameter in .NET Core to skip the certificate check.

We are a big university with ~1800 vPro enabled Clients and we use the functionality to install OS (Windows Image) and OS updates on 5 locations in switzerland. https://www.ost.ch/en/

PowerShell 7.0 (LTS) was released in March 4, 2020. We need to keep our servers up to date an cannot use the old PowerShell version forever. Hope you can give me some positive feedback in this case.

Regards,

Raphael

[MIGUEL_C_Intel]

Hello, Raphi,

I understand your concern.  

There is no date for a newer release yet. I will gladly notify you when Intel releases the newer version through this post. 

Regards,

Miguel C.

Intel Customer Support Technician

[Raphi]

Hello Miguel,

thanks for your response. Hope for a new version with PowerShell 7 support soon.

Regards Raphael

[Jimmy_Wai_Intel]

Hi Raphi,

While you are waiting for a new version that supports PowerShell 7, would you be interested to explore Intel End Point Management Assistant (Intel EMA) which is the latest solution supporting Intel AMT on the clients?

Regards,

Jimmy Wai

Technical Sales Specialist, Intel

[Raphi]

Hi Jimmy,

yes I would like to explore Intel End Point Management Assistant (Intel EMA). Can you give me further detailed information for it?

Regards Raphael

[Jimmy_Wai_Intel]

Hi Raphi,

Intel EMA is available to download at the link below. Please send me an email to jimmy dot wai at intel dot com. I can share more detailed information. 

https://www.intel.com/content/www/us/en/download/19449/intel-endpoint-management-assistant-intel-ema.html

Regards,

Jimmy Wai

Technical Sales Specialist, Intel

[Raphi]

I have found a workaround using the Intel vPro Technology Module for Windows PowerShell with PowerShell 7.4.

Just use following parameter for importing the module, it will import with PowerShell 5.1 compatibility mode:

Import-Module "$envRoot\modules\IntelvPro\18.0.0.1\IntelvPro.psd1" -UseWindowsPowerShell

Found this in the Microsoft docs:

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_windows_powershell_compatibility?view=powershell-7.4

It would be nice if Intel can push a new version that runs with PowerShell 7.4 without compatiblity mode but this workaround can be used in the meantime.