Enable support for WinRM over HTTPS

[Copilot]

CIS-hardened environments disable WinRM over HTTP (port 5985), breaking all PSRemoting-based diagnostics. This adds first-class -UseSSL and -Port support throughout the PSRemoting call chain so diagnostics work with HTTPS (port 5986).

Description

Summary of changes:

• New-PSRemotingSession: Added -UseSSL switch and -Port parameter. Defaults to port 5986 when SSL is enabled, 5985 otherwise. Falls back to $Global:SdnDiagnostics.Config.UseSSL/Port when not explicitly provided, allowing module-wide configuration without per-call parameter threading. Skips WinRM TrustedHosts management for IP addresses when using SSL (certificate validates identity). Made New-PSSessionOption platform-aware to allow Linux test compatibility.
• Invoke-PSRemoteCommand, Copy-FileFromRemoteComputerWinRM, Copy-FileToRemoteComputerWinRM, Copy-FileFromRemoteComputer, Copy-FileToRemoteComputer: Added -UseSSL and -Port parameters propagated to New-PSRemotingSession.
• $Global:SdnDiagnostics.Config: Added UseSSL = $false and Port = 0 defaults for module-wide transport configuration.
• Start-SdnDataCollection: Added -UseSSL and -Port parameters; sets global config so all downstream calls inherit the transport settings. Fixed the WinRM pre-flight connectivity check (was hardcoded to 5985) to derive port from global config.
• Tests: Added 5 Pester tests covering port auto-selection (SSL→5986, HTTP→5985), explicit port override, and global config inheritance.

# Module-wide HTTPS config — all subsequent PSRemoting calls use port 5986
$Global:SdnDiagnostics.Config.UseSSL = $true

# Or per-invocation
Start-SdnDataCollection -NcUri $nc -UseSSL

# Or fine-grained
Invoke-PSRemoteCommand -ComputerName $node -UseSSL -Port 5986 -ScriptBlock { ... }

Change type

• New Feature (non-breaking change that adds new functionality without impacting existing)

Checklist:

• My code follows the style and contribution guidelines of this project.
• I have tested and validated my code changes.

• Fixes Enable support for WinRM over HTTPS #423

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (5)

src/modules/SdnDiag.Utilities.psm1:2093

• HTTPS authenticates the server certificate, but it does not make Kerberos support an IP-address target. WinRM connections addressed by IP still require explicit credentials; otherwise this branch proceeds with default credentials and the session fails authentication. Keep the credential requirement independent of UseSSL.

                    if ($isIpAddress -and -NOT $UseSSL -and $Credential -eq [System.Management.Automation.PSCredential]::Empty) {

src/modules/SdnDiag.Utilities.psm1:1954

• An existing SdnDiag-* session is reused solely by computer name, so a prior HTTP/5985 session can be returned even when this new option requests HTTPS or a different port. That makes transport changes ineffective until sessions are manually removed or -Force is used. Match reusable sessions on the requested URI scheme and port (or create a new session when either differs).

        [Parameter(Mandatory = $false)]
        [Switch]$UseSSL,

        [Parameter(Mandatory = $false)]
        [System.Int32]$Port

src/SdnDiagnostics.psm1:955

• ForEach-Object -Parallel invokes this mutation concurrently, but ArrayList is not thread-safe. Simultaneous failures can race while adding entries, potentially omitting unreachable nodes or corrupting the collection. Use a thread-safe collection for the shared results.

                    [void]($using:nodesToRemove).Add($_)

src/SdnDiagnostics.psm1:770

• The exported cmdlet adds UseSSL and Port, but its comment-based help does not include .PARAMETER entries for either option. Add descriptions covering HTTPS selection, automatic ports, and the custom-port override so Get-Help Start-SdnDataCollection -Full documents the new public API.

        [Switch]$UseSSL,

        [Parameter(Mandatory = $false, ParameterSetName = 'Role')]
        [Parameter(Mandatory = $false, ParameterSetName = 'Computer')]
        [System.Int32]$Port

src/SdnDiagnostics.psm1:790

• The exported Start-SdnDataCollection path now mutates module-wide transport settings and selects the preflight port, but the added tests only exercise New-PSRemotingSession. Please add offline Pester coverage verifying that -UseSSL/-Port update the configuration and that the preflight uses 5986 or the explicit port.

    if ($PSBoundParameters.ContainsKey('UseSSL')) {
        $Global:SdnDiagnostics.Config.UseSSL = $UseSSL.IsPresent
    }

    if ($PSBoundParameters.ContainsKey('Port')) {