TFS On Premise Build Agent - Could not establish trust relationship for the SSL/TLS secure channel
<p>I have setup one TFS On-Premise Build Agent as a service using the instructions listed <a href="https://www.visualstudio.com/en-us/docs/build/admin/agents/v1-windows" rel="nofollow noreferrer">here</a>. I setup the accompanying Agent pool, permissions, build controller, etc.. and worked through most of the setup challenges around getting the agent to connect and run. I now have a agent that is connected and able to run builds:</p>
<p><a href="https://i.stack.imgur.com/JvlGK.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/JvlGK.png" alt="enter image description here" /></a>
<a href="https://i.stack.imgur.com/9PfoU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/9PfoU.png" alt="enter image description here" /></a></p>
<p>My configuration looks something like this:</p>
<blockquote>
<p>&quot;settings.json&quot; - &quot;ServerURL&quot;: <a href="http://tfs.XXXXXXXXX.com:80/tfs" rel="nofollow noreferrer">http://tfs.XXXXXXXXX.com:80/tfs</a></p>
<p>&quot;Listen for Build Agent communication on:&quot; <a href="http://XXXXXXXXXXX.com:9191/Build/v5.0/Services" rel="nofollow noreferrer">http://XXXXXXXXXXX.com:9191/Build/v5.0/Services</a></p>
</blockquote>
<p>But when I try to run any build using my newly configured Agent Pool it always fails when an entry in the Agent's log:</p>
<blockquote>
<p>System.Net.Http.HttpRequestException: An error occurred while sending
the request. ---&gt; System.Net.WebException: The underlying connection
was closed: Could not establish trust relationship for the SSL/TLS
secure channel. ---&gt;
System.Security.Authentication.AuthenticationException: The remote
certificate is invalid according to the validation procedure.</p>
<p>The Agent
failed to start this job. Error: An error occurred while sending the
request.</p>
</blockquote>
<p>This is very confusing to me because nowhere in my TFS configuration am I using SSL. How would it fail on a bad certificate(in this case self-signed) if I'm not using port 443 to connect to it. When I connect through a web browser(firefox) to that location I'm not automatically redirected to &quot;https&quot;. Is the agent somehow being redirected? Again, I'm able to connect without issue(or failing certificate) to the listed URLs, but It seems for some reasons the agent is not.</p>
<p>I'm not sure if I'm the only one who's got this issue. I think <a href="https://stackoverflow.com/questions/5175791/msdeploy-using-msbuild-from-tfs-2010-could-not-establish-trust-relationship-for">this</a> is related, but not the same version of software. There's a million other references to this error message, but I don't see a single one with the same context or configuration. Has anyone ever seen this issue before?</p>