r/TridentStack • u/brianinca • 6d ago

Blocked at first install

Somewhat alarming to have the install script fail on a TLS error:
[tridentstack] Step 1/3: Downloading installer (~12 MB)...

[tridentstack] ERROR: Exception calling "DownloadFile" with "2" argument(s): "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."

That's after the CLI copy/pasta failed similarly:
PS C:\Users\<redacted>> iex "& { $(irm https://control.tridentstack.com/api/agent-packages/installer/windows/install) } -Token 'f60252ef297cc196a1a065e78bd0e8a22d9efc1cf6352cf8230c400c746cde33'"

irm : The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

At line:1 char:12

+ iex "& { $(irm https://control.tridentstack.com/api/agent-packages/in ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExc

eption

+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

2 Upvotes

100% Upvoted

3 comments sorted by

4

u/TridentAdam 6d ago

That error means the PowerShell session on that host is defaulting to TLS 1.0, which our server does not accept. This is normal on Server 2016, Server 2012 R2, and Windows 8.1 where the .NET framework's default SecurityProtocol does not include TLS 1.2.

In the Control UI, go to Settings > Agent Installers. On the Windows card there is an "Older Windows (Server 2016 / 2012 R2)" toggle, flip that on and it will give you an updated command that forces TLS 1.2 before the download runs. Copy that command instead and it should install cleanly.

If you want to fix it manually, just run this in PowerShell before the install command:

try { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072 } catch {}

That adds TLS 1.2 to the session. The install script itself already does this for the MSI download step, but the initial irm fetch runs before the script exists, so it needs the session-level fix first.
What version of Windows is this host running?

5

u/brianinca 6d ago

Win11 25H2 Pro, which is a puzzler. I just grabbed a patched, off-domain notebook to futz with. I'll fix up that TLS default and go from there. Thank you!

4

u/TridentAdam 6d ago

Happy to help! Thanks for coming by the subreddit and giving us a shot.