make a request with TLS1.2 using IIS7.5 on Windows Server 2008 R2

Question

I have a webservice made in C#. It consumes other web service, but it always use SSL3 or TLS1.0.

I have changed the registry like this link: https://www.derekseaman.com/2010/06/enable-tls-12-aes-256-and-sha-256-in.html#uds-search-results

If on the registry, i disable TLS1.0, it tries to make the request with SSL3, If i disable SSL3 it doesn't make the request. If i put the TLS1.2 ciphers only on the gpedit, it doesn't make the request. I think that TLS1.2 only works when answer a request, not when consume.

This are the suite ciphers that IIS use:

TLS 1.0:

Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004)

SSL3:

Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)

If i use a stand alone c# application, it uses TLS1.2, but when it is managed by IIS, doesn't do this.

I use .NET 3.5, running on .NET4.0 (on the properties of project, i have .NET 3.5, on the web.config, i have ). This is because i need to use WSE3. The runtime of .Net is v4.0.30319

Are you able to recompile your projects using .NET 4.6? There are some workarounds with the older Frameworks, but I've been down that road, and it's not worth it. — Tung

Richard Richard · Accepted Answer · 2018-09-26T09:36:48

To support TLS 1.1/1.2 as a client on older versions of .NET you need to enable those protocols on ServicePointManager.

But the enumeration normally used for this doesn't have the necessary fields, but the underlying values do work if the installation is fully patched. Using VB.Net (as it is code I have to hand):

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls _
                    Or DirectCast(&H300, SecurityProtocolType) _
                    Or DirectCast(&HC00, SecurityProtocolType)

make a request with TLS1.2 using IIS7.5 on Windows Server 2008 R2

1 Answers