So I think we also need a --basic-auth switch to allow basic auth to be used, but only for ssl listeners. The reason for this is that ntlm auth won't work unless the winrm client is running Windows. Basic auth is generally not desirable, but within an ssl connection the credentials are protected over the wire. It should certainly not be default behavior, but users on non-Windows platforms can choose to have less defense in depth.