Container-based solution build errors with "Could not create SSL/TLS secure channel"

Question

I am doing container-based builds of my Sitecore solution, based on examples provided by Sitecore. However when I attempt to build, I get the following error:

RUN Invoke-WebRequest "https://dist.nuget.org/win-x86-commandline/v$env:NUGET_VERSION/nuget.exe" -UseBasicParsing -OutFile "$env:ProgramFiles\NuGet\nuget.exe"
 ---> Running in 99e111499461
Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure
channel.

I can invoke this command successfully from my Docker host. How can I resolve this error, and what is the cause?

Answer 1

Quick Fix

Search your solution for any references to the Docker image tag mcr.microsoft.com/dotnet/framework/sdk:4.8 and replace them with mcr.microsoft.com/dotnet/framework/sdk:4.8-windowsservercore-ltsc2019.

Explanation

Many of the examples provided by Sitecore use .NET Framework SDK images provided by Microsoft as a base for solution builds. When the Microsoft image tags do not contain an OS version, they are often actually references to a manifest associated with the tag to determine the actual image that will be used, based on the OS version of the Docker host.

You can see the available OS images associated with a manifest with the docker manifest inspect command.

docker manifest inspect mcr.microsoft.com/dotnet/framework/sdk:4.8

If Microsoft does not have an SDK image for your exact Windows version (perhaps you are using a new or old SAC release), you may end up with LTSC2016, which does not have TLS 1.2 enabled, thus the TLS error downloading NuGet.exe.

You can see the Windows version of the image actually being used in your Docker host via docker image inspect.

docker image inspect mcr.microsoft.com/dotnet/framework/sdk:4.8 --format '{{ .OsVersion }}'
10.0.14393.4402

In the output above, 10.0.14393 would indeed indicate use of LTSC2016.

Answer 2

I used to fix this one by adding TLS 1.2 support to each Invoke-WebRequest command:

ENV NUGET_VERSION 5.6.0
RUN [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; `
    Invoke-WebRequest "https://dist.nuget.org/win-x86-commandline/v$env:NUGET_VERSION/nuget.exe" -UseBasicParsing -OutFile "$env:ProgramFiles\NuGet\nuget.exe"

doesn't this work for you?