Fun thing about Invoke-WebRequest is that it uses TLS1.0 by default and doesn't understand anything newer unless you enter an incantation beforehand:

[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12