Azure DevOps Powershell 脚本无法创建 SSL/TLS 安全通道

Question

问题:
如果我从 DevOps 管道中的 'Azure Powershell' 任务调用命令 Get-AzureDeployment(也称为 Get-AzureService)，我将得到:'请求已中止:可以不创建 SSL/TLS 安全通道。'

简介:

• 我使用 Azure DevOps 将 Azure 云服务(经典)部署到 Azure
• “Azure Powershell”任务一直在运行，但在没有更改任何内容的情况下它停止了运行
• 我还将证书(由 DevOps 使用)导入到我的电脑中(通过 Import-AzurePublishSettingsFile)并尝试运行相同的 powershell 脚本，而 everytnig 工作正常，因此我预计 DevOps 会出现问题<

DevOps 连接:

• 我已在 Azure DevOps 中创建“服务连接”以连接到 Azure
• 服务连接类型为“Azure 经典”(因为“Azure 资源管理器”不适用于“云服务经典”)
• 身份验证方法“Azure 经典服务连接”是“基于证书”。
• 我用过由“发布设置文件”为我的 azure 生成的证书订阅。该证书已被 azure 放入我的订阅->管理证书(到期日为年中)2021)
• 我使用此服务连接将应用程序(云服务经典)部署到 Azure 没有任何问题(通过 DevOps 任务“Azure 云服务部署”)但是只是“Azure Powershell”任务开始失败。

这一切都工作了 3 个月，然后因任何原因停止工作。奇怪的是，当我使用 DevOps 来找出问题所在时，任务曾经成功运行，但当我再次尝试时，我再次遇到错误。

我有成功调用和失败调用的日志。 2506行日志是相同的，变化是在这行之后。

我可以向您发送完整的日志，但我不想在这里放置这么长的日志。

尝试成功:

VERBOSE: 8:31:40 AM - Begin Operation: Get-AzureDeployment
VERBOSE: 8:31:42 AM - Completed Operation: Get-AzureDeployment
... some other info about the deployment in slot

记录失败的调用:

VERBOSE: 9:53:39 AM - Begin Operation: Get-AzureDeployment
##[debug]Caught exception from task script.
##[debug]Error record:
##[debug]Get-AzureDeployment : An error occurred while sending the request.
##[debug]At D:\a\r1\a\_Tools\Powershell\cloud-service_swap-slot.ps1:14 char:15
##[debug]+ ... eployment = Get-AzureDeployment -Slot "Staging" -ServiceName $CloudSe ...
##[debug]+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
##[debug]    + CategoryInfo          : CloseError: (:) [Get-AzureDeployment], HttpRequestException
##[debug]    + FullyQualifiedErrorId : Microsoft.WindowsAzure.Commands.ServiceManagement.HostedServices.GetAzureDeploymentComma    nd
##[debug] 
##[debug]Script stack trace:
##[debug]at <ScriptBlock>, D:\a\r1\a\_Tools\Powershell\cloud-service_swap-slot.ps1: line 14
##[debug]at <ScriptBlock>, <No file>: line 1
##[debug]at <ScriptBlock>, D:\a\_tasks\AzurePowerShell_72a1931b-effb-4d2e-8fd8-f8472a07cb62\3.171.2\AzurePowerShell.ps1: line 145
##[debug]at <ScriptBlock>, D:\a\_tasks\AzurePowerShell_72a1931b-effb-4d2e-8fd8-f8472a07cb62\3.171.2\AzurePowerShell.ps1: line 141
##[debug]at <ScriptBlock>, <No file>: line 1
##[debug]at <ScriptBlock>, <No file>: line 22
##[debug]at <ScriptBlock>, <No file>: line 18
##[debug]at <ScriptBlock>, <No file>: line 1
##[debug]Exception:
##[debug]System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.
##[debug]   at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
##[debug]   at System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)
##[debug]   --- End of inner exception stack trace ---
##[debug]   at Microsoft.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
##[debug]   at Microsoft.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccess(Task task)
##[debug]   at Microsoft.WindowsAzure.Management.Compute.DeploymentOperationsExtensions.GetBySlot(IDeploymentOperations operations, String serviceName, DeploymentSlot deploymentSlot)
##[debug]   at Microsoft.WindowsAzure.Commands.Utilities.Common.ServiceManagementBaseCmdlet.ExecuteClientActionNewSM[TResult](Object input, String operationDescription, Func`1 action, Func`3 contextFactory)
##[error]An error occurred while sending the request.
##[debug]Processed: ##vso[task.logissue type=error]An error occurred while sending the request.
##[debug]Processed: ##vso[task.complete result=Failed]

在这两个日志中，我还可以找到将 Azure 帐户添加到 Powershell 中的信息:

##[debug]Added certificate to the certificate store.
##[command]Set-AzureSubscription -SubscriptionName PXX -SubscriptionId XXXXXX01-09f5-4703-bcc9-6ff914XXXXXX -Certificate ******** -Environment AzureCloud 
##[command]Select-AzureSubscription -SubscriptionId XXXXXX01-09f5-4703-bcc9-6ff914XXXXXX
##[debug]Leaving Initialize-Azure.
## Initializing Azure Complete 

(我已经用X替换了一些字符串)

YAML中有Powershell任务:

steps:
- task: AzurePowerShell@3
  displayName: 'Swap slots'
  inputs:
    azureConnectionType: ConnectedServiceName
    azureClassicSubscription: 'PXX subscription'
    ScriptPath: '$(System.DefaultWorkingDirectory)/_Tools/Powershell/cloud-service_swap-slot.ps1'
    ScriptArguments: '-CloudServiceName $(CloudServiceName)'
    FailOnStandardError: true
    azurePowerShellVersion: LatestVersion

用于交换插槽的 Powershell 脚本可以在本地电脑(具有相同的证书)上运行，但在 DevOps 中失败:

[CmdletBinding(PositionalBinding=$True)]
Param(
    [Parameter(Mandatory = $true)]
    [String]$CloudServiceName              # required
)

# Check if Windows Azure Powershell is avaiable 
if ((Get-Module -ListAvailable Azure) -eq $null) 
{ 
    throw "Windows Azure Powershell not found! Please install from http://www.windowsazure.com/en-us/downloads/#cmd-line-tools" 
} 
 
# VIP Swap
$Deployment = Get-AzureDeployment -Slot "Staging" -ServiceName $CloudServiceName #It's failing here
if ($Deployment -ne $null -AND $Deployment.DeploymentId  -ne $null) 
{ 
     Write-Output ("Current Status of staging in {0}" -f $CloudServiceName); 
     Write-Host ($Deployment | Select-Object -Property * -ExcludeProperty Configuration,RolesConfiguration | Format-List | Out-String);

     $MoveStatus = Move-AzureDeployment -ServiceName $CloudServiceName 
     Write-Output ("Vip swap of {0} status: {1}" -f $CloudServiceName, $MoveStatus.OperationStatus)     
}else 
{ 
     Write-Output ("There is no deployment in staging slot of {0} to swap." -f $CloudServiceName) 
} 

有人和我有同样的经历吗？问题可能出在哪里？

# 更新

我尝试在脚本开头添加此安全协议(protocol)设置，但出现相同的错误。

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Answer 1

这似乎是 Microsoft 构建代理的问题，但将以下代码添加到每个 Azure Powershell 任务的开头似乎已经为我们解决了这个问题，直到他们能够解决这个问题。

$pcert = (Get-Variable Endpoint -ValueOnly).Auth.Parameters.certificate
$bytes = [convert]::FromBase64String($pcert) 
[IO.File]::WriteAllBytes("C:\cert.pfx",$bytes) 
$null = Import-PfxCertificate -FilePath C:\cert.pfx -CertStoreLocation cert:\CurrentUser\My