http - BitsTransfer 不适用于在 Windows 7 上使用 http 或 https 的 megatools

Question

我有一个关于在 powershell 上使用 Bitstransfer 以通过 https 下载数据的问题。以下代码在 windows 10 的 powershell 5.5 上运行良好，但在 windows 7 的 powershell 2.2 或 4.4 上不起作用。特别是，问题似乎是特定网站 megatools 的使用。因为 https 即使在 Windows 7 上也能正常工作。

Import-ModuleBitstransfer
Start-BitsTransfer-source "https://en.wikipedia.org/wiki/File:Example.jpg"

如果我尝试从 https://megatools.megous.com/ 下载文件例如https://megatools.megous.com/builds/megatools-1.9.97-win64.zip它不适用于 https 和 http。

PS C:\Users\user\Desktop> Start-BitsTransfer -source https://megatools.megous.com/builds/megatools-1.9.97-win64.zip
Start-BitsTransfer : Unable to connect to server
On row:1 car:1+ Start-BitsTransfer -source https://megatools.megous.com/builds/megatools-1.9.97- ...+ ~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : InvalidOperation: (:) [Start-BitsTransfer], Exception    + FullyQualifiedErrorId : StartBitsTransferCOMException,Microsoft.BackgroundIntelligentTransfer.Management.NewBits   TransferCommand
PS C:\Users\user\Desktop> Start-BitsTransfer -source http://megatools.megous.com/builds/megatools-1.9.97-win64.zip
Start-BitsTransfer : Unable to connect to server
On row:1 car:1+ Start-BitsTransfer -source https://megatools.megous.com/builds/megatools-1.9.97- ...+ ~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : InvalidOperation: (:) [Start-BitsTransfer], Exception    + FullyQualifiedErrorId : StartBitsTransferCOMException,Microsoft.BackgroundIntelligentTransfer.Management.NewBits   TransferCommand

你能解释一下为什么吗？

谢谢

附言我向 megatools 维护者报告了错误，他们说了以下内容:

megatools.megous.com 通过 https 提供服务(TLS 1.2 是协议(protocol)的最低允许版本，它还使用带有主题 alt 名称的证书，服务器使用 SNI)。nginx 服务器配置ssl_protocols TLSv1.2；ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

Answer 1

经过很长时间的分析，我找到了解决方案。简而言之，Windows 7 不支持 TLS v1.1 或 v1.2，即使可以安装它们。我用这个测试网站分析网站https://www.ssllabs.com/ssltest/下面是megatools.megous.com的配置报告协议(protocol)

TLS 1.2     Yes    
TLS 1.1     No
TLS 1.0     No
Cipher Suites (SSL 3+ suites in server-preferred order; deprecated and SSL 2 suites at the end)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     128
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)   DH 4096 bits   FS     256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)   DH 4096 bits   FS     128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x6b)   DH 4096 bits   FS     256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)   DH 4096 bits   FS     256

虽然这是mega.nz的配置报告

Protocols
TLS 1.2     Yes    
TLS 1.1     Yes
TLS 1.0     Yes
SSL 3     No    
SSL 2     No
Cipher Suites (SSL 3+ suites in server-preferred order; deprecated and SSL 2 suites at the end)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     128
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)     112
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc13)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     256

和 wikipedia.org

Protocols
TLS 1.2     Yes    
TLS 1.1     Yes
TLS 1.0     Yes
SSL 3     No    
SSL 2     No
Cipher Suites (SSL 3+ suites in server-preferred order; deprecated and SSL 2 suites at the end)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     128
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     128
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)   DH 2048 bits   FS     128
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)   DH 2048 bits   FS     256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     128
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     128
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     256
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc008)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     112
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012)   ECDH secp256r1 (eq. 3072 bits RSA)   FS     112
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x67)   DH 2048 bits   FS     128
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x6b)   DH 2048 bits   FS     256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)   DH 2048 bits   FS     128
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)   DH 2048 bits   FS     256
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (0x45)   DH 2048 bits   FS     128
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (0x88)   DH 2048 bits   FS     256
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)     128
TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)     256
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)     128
TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d)     256
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)     128
TLS_RSA_WITH_AES_256_CBC_SHA (0x35)     256
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)     112

我使用了这个脚本 https://gist.github.com/erotavlas85/289c38e7c076fda9349e为了测试 Windows SSL 功能，这是输出 https://gist.githubusercontent.com/erotavlas85/2c251af8625a77cd7db1/raw/65c777ee60edc498382e826097cd3568bb0a2eac/SSL%2520output此外，所有 TLS 版本都已启用，但是我在此 https://palmarg.wordpress.com/2014/06/09/enabling-tls-1-2-using-powershell/ 之后手动添加了 Windows 注册表项无论如何输出相同。最后，我通过 https://mozilla.github.io/server-side-tls/ssl-config-generator/ 通知网站管理员降低了网络服务器的安全要求。现在它就像一个魅力。