"Invoke-WebRequest : The underlying connection was closed: An unexpected error

Question

Below is the code in my custom script extension

$AllProtocols = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12'
[System.Net.ServicePointManager]::SecurityProtocol = $AllProtocols
Invoke-WebRequest -Uri https://aka.ms/downloadazcopy-v10-windows -OutFile $env:C:\temp\azcopy.zip

when I run my custom script extension , I am getting below error

"Invoke-WebRequest : The underlying connection was closed: An unexpected error

Any help on how to resolve it ?

Answer 1

That error is pretty specific, which makes this potentially an environmental issue on your host or in your enterprise environment, as the code you posted, should/does work as-is.

# Tested on a few lab hosts
$AllProtocols = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12'
[System.Net.ServicePointManager]::SecurityProtocol = $AllProtocols
Invoke-WebRequest -Uri https://aka.ms/downloadazcopy-v10-windows -OutFile $env:C:\temp\azcopy.zip -Verbose
Get-ChildItem C:\temp

# Results
<#
VERBOSE: GET https://aka.ms/downloadazcopy-v10-windows with 0-byte payload
VERBOSE: received 9317519-byte response of content-type application/zip


    Directory: C:\temp


Mode                 LastWriteTime         Length Name                                                   
----                 -------------         ------ ----                                                   
-a----         9/11/2020   8:45 PM        9317519 azcopy.zip                                             
#>

Yet you really only need this at the top of your code.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

You can get more about the error by running the code, let the error happen and then using

$Error[0] | Format-List -Force

You can also find out more by using the Trace-Command cmdlet.

Trace-Command -Name metadata,parameterbinding,cmdlet -Expression {
    Invoke-WebRequest -Uri https://aka.ms/downloadazcopy-v10-windows -OutFile $env:C:\temp\azcopy.zip
} -PSHost
# Results
<#
DEBUG: ParameterBinding Information: 0 : BIND NAMED cmd line args [Invoke-WebRequest]
DEBUG: ParameterBinding Information: 0 :     BIND arg [https://aka.ms/downloadazcopy-v10-windows] to parameter [Uri]
DEBUG: ParameterBinding Information: 0 :         COERCE arg to [System.Uri]
DEBUG: ParameterBinding Information: 0 :             Trying to convert argument value from System.String to System.Uri
DEBUG: ParameterBinding Information: 0 :             CONVERT arg type to param type using LanguagePrimitives.ConvertTo
DEBUG: ParameterBinding Information: 0 :             CONVERT SUCCESSFUL using LanguagePrimitives.ConvertTo: [https://aka.ms/downloadazcopy-v10-windows]
DEBUG: ParameterBinding Information: 0 :         Executing VALIDATION metadata: [System.Management.Automation.ValidateNotNullOrEmptyAttribute]
DEBUG: ParameterBinding Information: 0 :         BIND arg [https://aka.ms/downloadazcopy-v10-windows] to param [Uri] SUCCESSFUL
DEBUG: ParameterBinding Information: 0 :     BIND arg [\temp\azcopy.zip] to parameter [OutFile]
DEBUG: ParameterBinding Information: 0 :         COERCE arg to [System.String]
DEBUG: ParameterBinding Information: 0 :             Parameter and arg types the same, no coercion is needed.
DEBUG: ParameterBinding Information: 0 :         BIND arg [\temp\azcopy.zip] to param [OutFile] SUCCESSFUL
DEBUG: ParameterBinding Information: 0 : BIND POSITIONAL cmd line args [Invoke-WebRequest]
DEBUG: ParameterBinding Information: 0 : MANDATORY PARAMETER CHECK on cmdlet [Invoke-WebRequest]
DEBUG: ParameterBinding Information: 0 : CALLING BeginProcessing
DEBUG: ParameterBinding Information: 0 : CALLING EndProcessing
#>

When trying to hit remote resources, it best to test for the liveliness/connection before taking action. Normally that's a Test-Connection/Test-NetConection thing, but in your case, one of the Invoke-* cmdlets would be more prudent.

Invoke-WebRequest -Uri 'https://aka.ms/downloadazcopy-v10-windows' -UseBasicParsing

# Results
<#
StatusCode        : 200
StatusDescription : OK
Content           : {80, 75, 3, 4...}
RawContent        : HTTP/1.1 200 OK
                    Content-MD5: HjZjoPa87mg1bK4eVQqASQ==
                    x-ms-request-id: aa4341fb-e01e-00a6-0c94-810077000000
                    x-ms-version: 2009-09-19
                    x-ms-lease-status: unlocked
                    x-ms-blob-type: BlockBlob
                    Connect...
Headers           : {[Content-MD5, HjZjoPa87mg1bK4eVQqASQ==], [x-ms-request-id, aa4341fb-e01e-00a6-0c94-810077000000], [x-ms-version, 2009-09-19], 
                    [x-ms-lease-status, unlocked]...}
RawContentLength  : 9317519
#>

See also this article.