What sets the TLS version used in C#
I have a C# web application which has references to a large number of projects.
The root web project is set to 4.7.1 framework version
In one of the sub projects, where a web request is made using WebRequest.Create(), that project is also set to 4.7.1
It was my understanding that anything from 4.6 and up uses Tls 1.2, but when I run the project,
ServicePointManager.SecurityProtocol
resolves to Ssl3
This application is hosted in Azure, not sure if that has an impact
So, what setting dictates which TLS to use? This works in our VM with TLS 1.2 the only enabled setting, but not in Azure
c# ssl
asked Nov 15 '18 at 19:45
andrewbandrewb
1,19132251
add a comment |
I have a C# web application which has references to a large number of projects.
The root web project is set to 4.7.1 framework version
In one of the sub projects, where a web request is made using WebRequest.Create(), that project is also set to 4.7.1
It was my understanding that anything from 4.6 and up uses Tls 1.2, but when I run the project,
ServicePointManager.SecurityProtocol
resolves to Ssl3
This application is hosted in Azure, not sure if that has an impact
So, what setting dictates which TLS to use? This works in our VM with TLS 1.2 the only enabled setting, but not in Azure
c# ssl
asked Nov 15 '18 at 19:45
andrewbandrewb
1,19132251
"This application is hosted in Azure" - are you running in an Azure App Service (Azure Website)? If so, note they're all upgraded to .NET 4.7.2 now.
– Dai
Nov 15 '18 at 19:47
Yes, app services, so why is TLS resolving to Ssl3?
– andrewb
Nov 15 '18 at 19:50
WithWebRequest, that is the default:SSL3+TLS1.0.HttpClienttreats it differently, it can select it, if the handshake requires it. Also note that from FW 4.7.2,ServicePointManageris not required anymore to select theSSLprotocol. It can be set directly using the HttpClientHandler.SslProtocols property (which is just a stub in FW 4.7.1).
– Jimi
Nov 15 '18 at 20:04
add a comment |
I have a C# web application which has references to a large number of projects.
The root web project is set to 4.7.1 framework version
In one of the sub projects, where a web request is made using WebRequest.Create(), that project is also set to 4.7.1
It was my understanding that anything from 4.6 and up uses Tls 1.2, but when I run the project,
ServicePointManager.SecurityProtocol
resolves to Ssl3
This application is hosted in Azure, not sure if that has an impact
So, what setting dictates which TLS to use? This works in our VM with TLS 1.2 the only enabled setting, but not in Azure
c# ssl
asked Nov 15 '18 at 19:45
andrewbandrewb
1,19132251
I have a C# web application which has references to a large number of projects.
The root web project is set to 4.7.1 framework version
In one of the sub projects, where a web request is made using WebRequest.Create(), that project is also set to 4.7.1
It was my understanding that anything from 4.6 and up uses Tls 1.2, but when I run the project,
ServicePointManager.SecurityProtocol
resolves to Ssl3
This application is hosted in Azure, not sure if that has an impact
So, what setting dictates which TLS to use? This works in our VM with TLS 1.2 the only enabled setting, but not in Azure
c# ssl
c# ssl
asked Nov 15 '18 at 19:45
andrewbandrewb
1,19132251
asked Nov 15 '18 at 19:45
andrewbandrewb
1,19132251
asked Nov 15 '18 at 19:45
andrewbandrewb
1,19132251
asked Nov 15 '18 at 19:45
andrewbandrewb
1,19132251
asked Nov 15 '18 at 19:45
andrewbandrewb
1,19132251
1,19132251
"This application is hosted in Azure" - are you running in an Azure App Service (Azure Website)? If so, note they're all upgraded to .NET 4.7.2 now.
– Dai
Nov 15 '18 at 19:47
Yes, app services, so why is TLS resolving to Ssl3?
– andrewb
Nov 15 '18 at 19:50
WithWebRequest, that is the default:SSL3+TLS1.0.HttpClienttreats it differently, it can select it, if the handshake requires it. Also note that from FW 4.7.2,ServicePointManageris not required anymore to select theSSLprotocol. It can be set directly using the HttpClientHandler.SslProtocols property (which is just a stub in FW 4.7.1).
– Jimi
Nov 15 '18 at 20:04
add a comment |
"This application is hosted in Azure" - are you running in an Azure App Service (Azure Website)? If so, note they're all upgraded to .NET 4.7.2 now.
– Dai
Nov 15 '18 at 19:47
Yes, app services, so why is TLS resolving to Ssl3?
– andrewb
Nov 15 '18 at 19:50
WithWebRequest, that is the default:SSL3+TLS1.0.HttpClienttreats it differently, it can select it, if the handshake requires it. Also note that from FW 4.7.2,ServicePointManageris not required anymore to select theSSLprotocol. It can be set directly using the HttpClientHandler.SslProtocols property (which is just a stub in FW 4.7.1).
– Jimi
Nov 15 '18 at 20:04
"This application is hosted in Azure" - are you running in an Azure App Service (Azure Website)? If so, note they're all upgraded to .NET 4.7.2 now.
– Dai
Nov 15 '18 at 19:47
"This application is hosted in Azure" - are you running in an Azure App Service (Azure Website)? If so, note they're all upgraded to .NET 4.7.2 now.
– Dai
Nov 15 '18 at 19:47
Yes, app services, so why is TLS resolving to Ssl3?
– andrewb
Nov 15 '18 at 19:50
Yes, app services, so why is TLS resolving to Ssl3?
– andrewb
Nov 15 '18 at 19:50
With
WebRequest, that is the default: SSL3 + TLS1.0. HttpClient treats it differently, it can select it, if the handshake requires it. Also note that from FW 4.7.2, ServicePointManager is not required anymore to select the SSL protocol. It can be set directly using the HttpClientHandler.SslProtocols property (which is just a stub in FW 4.7.1).– Jimi
Nov 15 '18 at 20:04
With
WebRequest, that is the default: SSL3 + TLS1.0. HttpClient treats it differently, it can select it, if the handshake requires it. Also note that from FW 4.7.2, ServicePointManager is not required anymore to select the SSL protocol. It can be set directly using the HttpClientHandler.SslProtocols property (which is just a stub in FW 4.7.1).– Jimi
Nov 15 '18 at 20:04
add a comment |
1 Answer
1
active
oldest
votes
Just set the SecurityProtocol property during your application's startup or before making any request:
const SecurityProtocolType tlsOnly = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12
ServicePointManager.SecurityProtocol = tlsOnly;
answered Nov 15 '18 at 19:48
DaiDai
73.6k13118205
Yes, but why isn't the project framework enforcing this?
– andrewb
Nov 15 '18 at 19:50
@andrewb If the behaviour was changed in a point-release of the .NET Framework it could potentially break many applications and systems depending on this behaviour. Microsoft values backwards-compatibility very heavily and the risk of a POODLE attack and associated damage (and cost to Microsoft) is less than the problems caused by breaking existing applications.
– Dai
Nov 15 '18 at 20:10
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53326876%2fwhat-sets-the-tls-version-used-in-c-sharp%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Just set the SecurityProtocol property during your application's startup or before making any request:
const SecurityProtocolType tlsOnly = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12
ServicePointManager.SecurityProtocol = tlsOnly;
answered Nov 15 '18 at 19:48
DaiDai
73.6k13118205
Yes, but why isn't the project framework enforcing this?
– andrewb
Nov 15 '18 at 19:50
@andrewb If the behaviour was changed in a point-release of the .NET Framework it could potentially break many applications and systems depending on this behaviour. Microsoft values backwards-compatibility very heavily and the risk of a POODLE attack and associated damage (and cost to Microsoft) is less than the problems caused by breaking existing applications.
– Dai
Nov 15 '18 at 20:10
add a comment |
Just set the SecurityProtocol property during your application's startup or before making any request:
const SecurityProtocolType tlsOnly = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12
ServicePointManager.SecurityProtocol = tlsOnly;
answered Nov 15 '18 at 19:48
DaiDai
73.6k13118205
Yes, but why isn't the project framework enforcing this?
– andrewb
Nov 15 '18 at 19:50
@andrewb If the behaviour was changed in a point-release of the .NET Framework it could potentially break many applications and systems depending on this behaviour. Microsoft values backwards-compatibility very heavily and the risk of a POODLE attack and associated damage (and cost to Microsoft) is less than the problems caused by breaking existing applications.
– Dai
Nov 15 '18 at 20:10
add a comment |
Just set the SecurityProtocol property during your application's startup or before making any request:
const SecurityProtocolType tlsOnly = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12
ServicePointManager.SecurityProtocol = tlsOnly;
answered Nov 15 '18 at 19:48
DaiDai
73.6k13118205
Just set the SecurityProtocol property during your application's startup or before making any request:
const SecurityProtocolType tlsOnly = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12
ServicePointManager.SecurityProtocol = tlsOnly;
answered Nov 15 '18 at 19:48
DaiDai
73.6k13118205
answered Nov 15 '18 at 19:48
DaiDai
73.6k13118205
answered Nov 15 '18 at 19:48
DaiDai
73.6k13118205
answered Nov 15 '18 at 19:48
DaiDai
73.6k13118205
73.6k13118205
Yes, but why isn't the project framework enforcing this?
– andrewb
Nov 15 '18 at 19:50
@andrewb If the behaviour was changed in a point-release of the .NET Framework it could potentially break many applications and systems depending on this behaviour. Microsoft values backwards-compatibility very heavily and the risk of a POODLE attack and associated damage (and cost to Microsoft) is less than the problems caused by breaking existing applications.
– Dai
Nov 15 '18 at 20:10
add a comment |
Yes, but why isn't the project framework enforcing this?
– andrewb
Nov 15 '18 at 19:50
@andrewb If the behaviour was changed in a point-release of the .NET Framework it could potentially break many applications and systems depending on this behaviour. Microsoft values backwards-compatibility very heavily and the risk of a POODLE attack and associated damage (and cost to Microsoft) is less than the problems caused by breaking existing applications.
– Dai
Nov 15 '18 at 20:10
Yes, but why isn't the project framework enforcing this?
– andrewb
Nov 15 '18 at 19:50
Yes, but why isn't the project framework enforcing this?
– andrewb
Nov 15 '18 at 19:50
@andrewb If the behaviour was changed in a point-release of the .NET Framework it could potentially break many applications and systems depending on this behaviour. Microsoft values backwards-compatibility very heavily and the risk of a POODLE attack and associated damage (and cost to Microsoft) is less than the problems caused by breaking existing applications.
– Dai
Nov 15 '18 at 20:10
@andrewb If the behaviour was changed in a point-release of the .NET Framework it could potentially break many applications and systems depending on this behaviour. Microsoft values backwards-compatibility very heavily and the risk of a POODLE attack and associated damage (and cost to Microsoft) is less than the problems caused by breaking existing applications.
– Dai
Nov 15 '18 at 20:10
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53326876%2fwhat-sets-the-tls-version-used-in-c-sharp%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
"This application is hosted in Azure" - are you running in an Azure App Service (Azure Website)? If so, note they're all upgraded to .NET 4.7.2 now.
– Dai
Nov 15 '18 at 19:47
Yes, app services, so why is TLS resolving to Ssl3?
– andrewb
Nov 15 '18 at 19:50
With
WebRequest, that is the default:SSL3+TLS1.0.HttpClienttreats it differently, it can select it, if the handshake requires it. Also note that from FW 4.7.2,ServicePointManageris not required anymore to select theSSLprotocol. It can be set directly using the HttpClientHandler.SslProtocols property (which is just a stub in FW 4.7.1).– Jimi
Nov 15 '18 at 20:04