Curl, PowerShell, Certificates and Proxies – Wolfgang Ziegler
July 13, 2015
Recently, I was working on a web application and tested it using the PowerShell curl command. All nice and smooth …Except for when I was using …The reason was the self-signed certificate I had been using for test purposes, which did not pass the validation check. Turning Off Certificate ValidationMy workaround was to switch to and PowerShell scripting in lieu of the built-in curl command. That way I could:Turn off certificate validation. []::ServerCertificateValidationCallback = { $true}Create a new WebClient object. $web = New-Object Net. WebClientPerform a DownloadString call to the HTTPS resource. $wnloadString(HTTPS_URL)What about Proxy Servers? Another requirement of my (test) use case was to involve a proxy server. Therefore I had to adapt my custom PowerShell curl script even further. I needed an instance of a WebProxy object:$proxy = New-Object Net. WebProxyThis new proxy objected needed some configuration:$dress = New-Object Uri(“PROXY_URL_OR_IP”)
$passProxyOnLocal = $false
$eDefaultCredentials = $false
$cred = New-Object tworkCredential(“USER”, “PASS”)
$edentials = $credThen, the proxy object was added to the formerly created WebClient instance$ = $proxyAnd the next call to DownloadString was going through the ’s the full code again. Hope you find this useful! []::ServerCertificateValidationCallback = { $true}
$web = New-Object Net. WebClient
$proxy = New-Object Net. WebProxy
$dress = New-Object Uri(“PROXY_URL_OR_IP”)
$edentials = $cred
$ = $proxy
$wnloadString(“CURL_URL”)
Buy me a coffee?
I see you have made it this far. Did you enjoy my blog post? If you did and you want to show your appreciation, maybe click the coffee mug below and sponsor me a cup of coffee.
Invoke-Webrequest to HTTPS website with proxy – Reddit
Hello guys, I’m trying to automate some URL testing using Invoke-WebRequest and a proxyRequest to with a browser using proxy is OK$Base64ProxyAuth = “123123123123123123=”
$Headers = @{“Proxy-Authorization” = “Basic ” + $Base64ProxyAuth}
$Proxy = ”
# HTTP test
$Uri =
Invoke-WebRequest -Uri $Uri -Proxy $Proxy -Headers $Headers
StatusCode: 200
StatusDescription: OK
# HTTPS test
Invoke-WebRequest -uri $uri -Proxy $Proxy -Headers $Headers
Invoke-WebRequest: ERROR: Access Denied
Error code: 02
Date: Fri, 20 Oct 2017 13:34:46 GMT
Request: /*
Any idea? Thanks! edit: thanks to u/fourierswager!! Solution:$ProxyAddress = ”
[]::defaultwebproxy = New-Object ($ProxyAddress)
$CredCache = []::new()
$NetCreds = []::new(“username”, “password”, “”)
$($ProxyAddress, “Basic”, $NetCreds)
[]edentials = $CredCache
[]passProxyOnLocal = $true
Invoke-WebRequest -uri ”
Using PowerShell Behind a Proxy Server | Windows OS Hub
If you can access the Internet from your computer only via a proxy server, then by default you won’t be able to access external web resources from your PowerShell session: a webpage (Invoke-WebRequest cmdlet), update help using the Update-Help cmdlet, connect to Office365/Azure, or download an application package from an external package repository (using PackageManagement or NanoServerPackage). In this article we’ll show you how to access web from a PowerShell session via a proxy server with the authentication.
Let’s try to update the PowerShell Help from a computer behind a proxy server:
Update-Help
Or access an external web page:
Invoke-WebRequest If you haven’t got a direct Internet connection, the command will return a similar error:
Update-help: Failed to update Help for the module(s) ‘DhcpServer, DirectAccessClientComponents…. ’ with UI culture(s) {en-US}: Unable to connect to Help content. The server on which Help content is stored might not be available. Verify that the server is available, or wait until the server is back online, and then try the command again.
Invoke-WebRequest: Unable to connect to the remote server.
InvalidOperation: ().
The matter is that PowerShell (or rather, the class, which these cmdlets used to access external resources over HTTP/HTTPS) does not use proxy settings specified in the Internet Explorer. However, the WebClient class has some properties that allow you to specify both proxy settings () and proxy authentication data (edentials or eDefaultCredentials). Let’s consider how to use these properties of the WebClient class.
Contents: Manage WinHTTP Proxy Server Settings for PowerShell
How to Set Proxy Authentication with PowerShell?
Set Proxy Server Settings in the PowerShell Profile File
Check Current Proxy Server Setting from PowerShell
Set Windows Proxy Setting Using PowerShell?
Manage WinHTTP Proxy Server Settings for PowerShell
Let’s check the current settings of the system proxy from PowerShell:
netsh win show proxy
As you can see, proxy settings are not specified:
Current WinHTTP proxy settings:
Direct access (no proxy server).
You can import proxy server settings from the Internet Explorer parameters:
netsh win import proxy source=ie
or set them manually:
netsh win set proxy “192. 168. 0. 14:3128″
If proxy authentication is necessary, the error like “(407) Proxy Authentication Required” will appear when you trying to run PowerShell commands. For example, when you try to connect to your Azure subscription with the command:
Add-AzureAccount -Credential (Get-Credential)
An error occurs:
Add-AzureAccount: user_realm_discovery_failed: User realm discovery failed: The remote server returned an error: (407) Proxy Authentication Required.
Let’s consider two ways of using proxy authentication: you can use Active Directory SSO authentication, or specify user credentials for authentication manually.
If you are authorized on your computer under a domain account, and your proxy server supports Active Directory Kerberos, or NTLM authentication (if you have not disabled it yet), then you can use the current user credentials to authenticate on the proxy server (you do not need to enter your username and password):
$Wcl = new-object
$(“user-agent”, “PowerShell Script”)
$ = []::DefaultNetworkCredentials
If you need to authenticate on the proxy server manually, run the following commands and specify user name and password in the corresponding credential window.
$Wcl=New-Object
$Creds=Get-Credential
$$Creds
Now you can try to access an external website or update the help using Update-Help command.
As you can see, the Invoke-Web Request cmdlet returned data from the external site webpage!
You can create a PowerShell profile file to automatically set proxy settings when PowerShell starts.
To do this, run the command that will create the PowerShell profile file (C:UsersusernameDocumentsWindowsPowerShell1):
notepad $PROFILE (or notepad $lUsersCurrentHost – if you need to apply a PowerShell profile to all users of the computer).
A PowerShell profile is a PS script that runs when your process starts.
Copy your PowerShell code into the notepad window. For example, you are using the Proxy Auto-Configuration (PAC) files to automatically configure proxy server settings on user computers. You can specify the URL address of the PAC file and authenticate on the proxy server under the current user with the following PowerShell profile script.
[]::DefaultWebProxy = new-object (”)
# If you need to import proxy settings from Internet Explorer, you can replace the previous line with the: “netsh win import proxy source=ie”
[]edentials = []::DefaultNetworkCredentials
# You can request user credentials:
#]edentials = Get-Credential
# Also, you can get the user password from a saved XML file (see the article “Using saved credentials in PowerShell scripts”):
#]::DefaultWebProxy= Import-Clixml -Path C:PS
[]passProxyOnLocal = $true
By default, the PowerShell script Execution Policy doesn’t allow all PS scripts to run, even from a PowerShell profile files. To allow scripts to run, you need to change your PowerShell Execution Policy. Run the command:
Set-ExecutionPolicy RemoteSigned
Save the 1 file and restart the PowerShell console window. Make sure that you can now access Web resources from a PowerShell session via a proxy without the need to run additional commands.
You can get the current proxy settings from the registry with the PowerShell command:
Get-ItemProperty -Path ‘HKCU:SoftwareMicrosoftWindowsCurrentVersionInternet Settings’ | Select-Object ProxyServer, ProxyEnable
In my example, the address and port of the proxy server are: 192. 1. 100:3128
Proxy server enabled: ProxyEnable =1
You can also get WebProxy settings like this:
[]::GetDefaultProxy()
If necessary, you can enable the use of proxy with the following command:
Set-ItemProperty -Path ‘HKCU:SoftwareMicrosoftWindowsCurrentVersionInternet Settings’ ProxyEnable -value 1
To disable proxy:
Set-ItemProperty -Path ‘HKCU:SoftwareMicrosoftWindowsCurrentVersionInternet Settings’ ProxyEnable -value 0
You can set proxy settings for current Windows user using PowerShell. For example, the following PowerShell function allows you to change proxy settings, but first it checks the availability of the proxy server and the port response on it using the Test-NetConnection cmdlet
function Set-Proxy ( $server, $port)
{
If ((Test-NetConnection -ComputerName $server -Port $port). TcpTestSucceeded) {
Set-ItemProperty -Path ‘HKCU:SoftwareMicrosoftWindowsCurrentVersionInternet Settings’ -name ProxyServer -Value “$($server):$($port)”
Set-ItemProperty -Path ‘HKCU:SoftwareMicrosoftWindowsCurrentVersionInternet Settings’ -name ProxyEnable -Value 1}
Else {
Write-Error -Message “Invalid proxy server address or port: $($server):$($port)”}}
Set-Proxy 192. 100 3128