I’ve been doing some VPN related stuff at work recently, and that has given me a need for a way to quickly check SSTP is responding on a server. To that end I knocked up a quick powershell function.
function Test-SstpServer {
<#
.SYNOPSIS
Tests whether a server is an SSTP server or not.
.DESCRIPTION
Tests whether a server is an SSTP server or not.
.PARAMETER Uri
The Uri of the server - the base i.e. https://vpn.domain.com may be used and the SSTP endpoint will be automatically added.
.PARAMETER SkipCertificateCheck
Ignore TLS Certificate errors.
.PARAMETER SstpEndpoint
The the SSTP specific URI endpoint.
.OUTPUTS
System.Boolean
.NOTES
See https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sstp/a4ea5dd9-21e8-41ae-adb9-15bd0a9b991c
#>
[CmdletBinding()]
param(
[Parameter(
Mandatory=$true
)]
[string]$Uri,
[Parameter()]
[switch]$SkipCertificateCheck,
[Parameter(
DontShow
)]
[string]$SstpEndpoint = '/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/'
)
process {
if ($Uri -notmatch $SstpEndpoint) {
$Uri = $Uri + $SstpEndpoint
}
$method = New-Object -TypeName System.Net.Http.HttpMethod -ArgumentList 'SSTP_DUPLEX_POST'
$request_message = New-Object -TypeName System.Net.Http.HttpRequestMessage -ArgumentList $method, $Uri
$request_message.Version = 1.1
$handler = New-Object -TypeName System.Net.Http.HttpClientHandler
if ($SkipCertificateCheck){
$handler.ServerCertificateCustomValidationCallback = [System.Net.Http.HttpClientHandler]::DangerousAcceptAnyServerCertificateValidator
}
$client = New-Object -TypeName System.Net.Http.HttpClient -ArgumentList $handler
Write-Verbose -Message "Testing $Uri"
try {
$response = $client.Send($request_message, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead)
} catch {
Write-Error -ErrorAction Stop -Message "TLS Validation error for $Uri"
}
$response.StatusCode -eq [System.Net.HttpStatusCode]::OK
}
}
Using [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead
stops the HttpClient
waiting for an age, as it’s just the OK header that we’re after.
I also added a -SkipCertificateCheck
to ease use where the correct certificate chain may not be installed.