Invalid Server Certificate after "Set-PowerCLIConfiguration -InvalidCertificateAction Ignore"

[AlfredoMoran]

After executing 'Set-PowerCLIConfiguration -InvalidCertificateAction Ignore', Connect-VIServer only works in ISE environment.

In a Powershell command line persist the "Error: Invalid server certificate. Use Set-PowerCLIConfiguration to set..."

[LucD]

What does it say when you do a Get-PowerCLIConfiguration?

Does it say Ignore for all 3 scopes?

You should specify the Scope when you do a Set-PowerCLIConfiguration

[AlfredoMoran]

Thankyou, LucD.

Yes, it does say Ignore in all 3 scopes: Session, User and AllUsers

And no problem inside ISE... :smileyconfused:

[LucD]

Does it say that inside ISE and from the PS prompt?
Can you make a screenshot of the error you get at the PS prompt?

[AlfredoMoran]

[LucD]

Did you stop/start your PS session (not the ISE one) after changing the setting in the ISE?

[AlfredoMoran]

I execute Set-PowerCLIConfiguration from the PS Session (outside ISE)

I also logoff my Windows desktop.

Nothing changes.

It's seems like Connect-VIServer only get correct powercli config from inside ISE.

[LucD]

No, that is definitely not the case.

It works from ISE and the PS prompt.

Do you by any chance have your profile on a network drive?

Can you try stopping all PS sessions (ISE and PS)?

And then manually remove the file $($env:APPDATA)\VMware\PowerCLI\PowerCLI_Settings.xml

That is where those settings are kept.

Now start a PS prompt and do the Set-PowerCLIConfiguration.

Is the file recreated?

[AlfredoMoran]

My profile is located in C:\Users\alfredo\AppData\Roaming as usual

(Note: I have PowerCLI modules installed under "My Documents", which is under OneDrive control, but not the profile path)

I close all sessions and ISE, remove the file and execute again Set-PowerCLIConfiguration but no luck.

The file is recreated, but the problem persists in the same way.

[LucD]

Can you do the same test with file "$($env:ProgramData)\VMware\PowerCLI\PowerCLI_Settings.xml"

That is the file where the settings for the AllUsers scope are kept.

I'm not sure if you did that already, but does Get-PowerCLIConfiguration from the PS prompt, return the same settings as when you do it from ISE?
The previous screenshot was from the ISE I guess.

Which PowerShell version are you using?
Can you check what $PSVersionTable returns?

[AlfredoMoran]

Thank you very much, LucD.

I did the same test with $($env:ProgramData)\VMware\PowerCLI\PowerCLI_Settings.xml file and same results again.

Exactly the same from PS Prompt

PSVersionTable:

I also reinstaled the VMware.PowerCLI module to start from scratch but nothing changes.

[LucD]

I only just noticed that you are using a very old ESXi version (4.1).

This could be an issue with the supported SSL protocols in both PS environments and not the certificate.

That old ESXi version requires TLS1.0 (shown as TLS).

Can you run the following from the PS prompt and in the ISE

[Net.ServicePointManager]::SecurityProtocol

When I do this, the ISE shows

while from the PS prompt, it shows

---------------------------------------------------------------------------------------------------------

Was it helpful? Let us know by completing this short survey here.

[AlfredoMoran]

Exactly like you! :smileyhappy:

That's the difference between environments.

you have done the right diagnostic

I add

[Net.ServicePointManager]::SecurityProtocol = 'Tls', 'Tls11','Tls12'

In the initialization fase and now it works

Thank you ver much, LucD

[AlfredoMoran]

Thankyou, LucD.

Yes, it does say Ignore in all 3 scopes: Session, User and AllUsers

And no problem inside ISE... :smileyconfused: