c# WCF Web service and how to detect client TLS version

1
votes

I have a .Net 4.6 WCF web service (.svc file in a web project) and I would like to obtain the TLS version of the connecting client so I can log this on the server side.

With this information I can create a report to inform customers affected before we turn off earlier versions of TLS.

Thanks

2
wcftls1.2

2 Answers

0
votes

We can see which TLS version is currently used in WCF by the below statement.

Console.WriteLine(System.Net.ServicePointManager.SecurityProtocol.ToString());

The possible values are the following Enum.
https://docs.microsoft.com/en-us/dotnet/api/system.net.securityprotocoltype?view=netframework-4.8
In fact, most of the value is SystemDefault. Unless the client has specified a version to use. This is because TLS communication requires the support of DotNet framework SDK and the OS version. The server and the client will preferentially use the latest (securer) version after negotiation. There is no way to obtain the practical version since it depends on the environment on the server-side and client-side.
Please see the link below for details.
https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls?view=netframework-4.8
The below link might be useful to you when we want to disable the TLS version on the server-side.
WCF Service TLS 1.2 Enforcement
Feel free to let me know if there is anything I can help with.

0
votes

In the end I decorated my WCF service with 

[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]

and then collected the information using;

  var CRYPT_PROTOCOL = Convert.ToString(HttpContext.Current.Request.ServerVariables["CRYPT_PROTOCOL"]);
  var CRYPT_CIPHER_ALG_ID = Convert.ToString(HttpContext.Current.Request.ServerVariables["CRYPT_CIPHER_ALG_ID"]);
  var CRYPT_HASH_ALG_ID = Convert.ToString(HttpContext.Current.Request.ServerVariables["CRYPT_HASH_ALG_ID"]);
  var CRYPT_KEYEXCHANGE_ALG_ID = Convert.ToString(HttpContext.Current.Request.ServerVariables["CRYPT_KEYEXCHANGE_ALG_ID"]);

CRYPT_PROTOCOL can be 400 for TLS1.2, 40 for TLS 1.0, 10 for SSLv3

I have not tested Abraham's reply (But thanks)