I am getting an error when trying to enable Tracing in one of our servers.

Commands used:

Add-PSSnapin Microsoft.Crm.PowerShell
Get-CrmSetting TraceSettings 


Get-CrmSetting : The underlying connection was closed: Could not establish trust relationship for the 
SSL/TLS secure channel.
At line:1 char:1
+ Get-CrmSetting TraceSettings
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (Microsoft.Crm.P...rmSettingCmdlet:GetCrmSettingCmdlet) [Get- 
   CrmSetting], WebException
    + FullyQualifiedErrorId : CRM Deployment Cmdlet Error,Microsoft.Crm.PowerShell.GetCrmSettingCmdlet

This is a multi-server environment where Web and Application are separate.


The error indicates that the certificate used on the end point you are trying to connect to is an un-trusted certificate.

I recommend ensuring that a valid and trusted certificate is used on the endpoint.

However if this is not possible you can set PowerShell to allow un-trusted certificates once per session with this function.

However be warned that running this function will disable ALL certificate checks that PowerShell would normally preform and the only way to reset this is to close and re-open PowerShell.

function Disable-SSLValidation
    Disables SSL certificate validation
    Disable-SSLValidation disables SSL certificate validation by using reflection to implement the System.Net.ICertificatePolicy class.
    Author: Matthew Graeber (@mattifestation)
    License: BSD 3-Clause
    Reflection is ideal in situations when a script executes in an environment in which you cannot call csc.ese to compile source code. If compiling code is an option, then implementing System.Net.ICertificatePolicy in C# and Add-Type is trivial.

    Set-StrictMode -Version 2

    # You have already run this function
    if ([System.Net.ServicePointManager]::CertificatePolicy.ToString() -eq 'IgnoreCerts') { Return }

    $Domain = [AppDomain]::CurrentDomain
    $DynAssembly = New-Object System.Reflection.AssemblyName('IgnoreCerts')
    $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
    $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('IgnoreCerts', $false)
    $TypeBuilder = $ModuleBuilder.DefineType('IgnoreCerts', 'AutoLayout, AnsiClass, Class, Public, BeforeFieldInit', [System.Object], [System.Net.ICertificatePolicy])
    $TypeBuilder.DefineDefaultConstructor('PrivateScope, Public, HideBySig, SpecialName, RTSpecialName') | Out-Null
    $MethodInfo = [System.Net.ICertificatePolicy].GetMethod('CheckValidationResult')
    $MethodBuilder = $TypeBuilder.DefineMethod($MethodInfo.Name, 'PrivateScope, Public, Virtual, HideBySig, VtableLayoutMask', $MethodInfo.CallingConvention, $MethodInfo.ReturnType, ([Type[]] ($MethodInfo.GetParameters() | % {$_.ParameterType})))
    $ILGen = $MethodBuilder.GetILGenerator()
    $TypeBuilder.CreateType() | Out-Null

    # Disable SSL certificate validation
    [System.Net.ServicePointManager]::CertificatePolicy = New-Object IgnoreCerts

Special thanks to Matt Graeber for authoring the code.

  • Doesn't [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true } do the same thing as all that stuff you posted? – Ryan Ries Jun 29 '16 at 17:39
  • To be honest I'm not entirely sure, you'd get a better answer from Matt Graeber. – Persistent13 Jun 29 '16 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.