SChannel error: The request was aborted: Could not create SSL/TLS secure channel

Question

I am trying to access and consume the XML at the following site: https://www.dhs.gov/ntas/1.1/alerts.xml. However, I keep getting the message: 'The request was aborted: Could not create SSL/TLS secure channel.' when I run my application on our dev server. I do not see anything in our server's event logs.

Strangely, when I access the feed from my localhost, it works fine.

My application is using .Net framework 4.6.2. As I understand, it should support TLS12 by default (unless I am wrong). When surf directly to the link, the browsers I tried -- Chrome, Firefox, Edge -- can access and display the XML successfully. IE11 is the exception and cannot display it.

I have tried adding TLS12 support manually in the following ways:

ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12
ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072 | (SecurityProtocolType)768 | SecurityProtocolType.Tls;

Here is the code I am using. As noted above this works on localhost.

                HttpWebRequest request = (HttpWebRequest)WebRequest.Create(NTASUri);
                request.UserAgent = Request.ServerVariables["HTTP_USER_AGENT"];

                WebResponse response = request.GetResponse();
                Stream dataStream = response.GetResponseStream();
                StreamReader reader = new StreamReader(dataStream);
                string responseFromServer = reader.ReadToEnd();

                XmlDocument xmlDoc = new XmlDocument();

                xmlDoc.LoadXml(responseFromServer);

                return xmlDoc.InnerXml;

Does anyone have any ideas on what can be done to get this working?

Jimbo Jimbo · Accepted Answer · 2020-06-20T00:11:34

My systems person ended up figuring this out, thankfully. We are now able to consume the feed on our server.

In the registry, the cipher suites listed under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002\ key were limited and only a subset of those supported by Windows.

Deleting the Functions string value which specifies a set of cipher suites returns the Windows client to the default behavior/order.

Further information:

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/manage-ssl-protocols-in-ad-fs

https://www.windows-security.org/2c488aac52906551ff218fd5c2bdaddc/ssl-cipher-suite-order

Hope this helps someone else in this situation.

SChannel error: The request was aborted: Could not create SSL/TLS secure channel

1 Answers