I have an app connecting to an Azure AppServer thorugh WebServices (using SoapHttpClientProtocol).
It was working perfectly on .NET 3.5sp1, when i upgraded to .NET 4.6.1, it works ok on w10 boxes, but some w7 or w8 fail with:
The underlying connection was closed: An unexpected error occurred on a send
If I modify the constructor adding:
System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Ssl3;
it does works. But i want to use Tls1.2, instead of Ssl3. if i use
System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12;
(or the default) it gives the error on the w7 and w8 boxes.
This is the list of ciphers presented to the server on the w10 (it works):
CONNECT spac-test.cloudapp.net:443 HTTP/1.1 Host: spac-test.cloudapp.net Connection: Keep-Alive
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.3 (TLS/1.2) Random: 58 17 93 A5 5C 57 36 C2 97 69 48 B2 92 5C 93 44 86 1A 87 99 19 53 4D 04 C4 CB EE C0 87 70 30 67 "Time": 1/10/2058 1:26:48 AM SessionID: empty Extensions: server_name xxx.cloudapp.net
elliptic_curves unknown [0x1D), secp256r1 [0x17], secp384r1 [0x18] ec_point_formats uncompressed [0x0]
signature_algs sha256_rsa, sha384_rsa, sha1_rsa, sha256_ecdsa, sha384_ecdsa, sha1_ecdsa, sha1_dsa, sha512_rsa, sha512_ecdsa SessionTicket empty
extended_master_secret empty renegotiation_info 00
Ciphers:
[C02C] TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 [C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [C030] TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 [C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [009F] TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 [009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [C024] TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 [C023] TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 [C028] TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 [C027] TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 [C00A] TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA [C009] TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA [C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA [C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA [0039] TLS_DHE_RSA_WITH_AES_256_SHA [0033] TLS_DHE_RSA_WITH_AES_128_SHA [009D] TLS_RSA_WITH_AES_256_GCM_SHA384 [009C] TLS_RSA_WITH_AES_128_GCM_SHA256 [003D] TLS_RSA_WITH_AES_256_CBC_SHA256 [003C] TLS_RSA_WITH_AES_128_CBC_SHA256 [0035] TLS_RSA_AES_256_SHA [002F] TLS_RSA_AES_128_SHA [000A] SSL_RSA_WITH_3DES_EDE_SHA [006A] TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 [0040] TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 [0038] TLS_DHE_DSS_WITH_AES_256_SHA [0032] TLS_DHE_DSS_WITH_AES_128_SHA [0013] SSL_DHE_DSS_WITH_3DES_EDE_SHA
Compression: [00] NO_COMPRESSION
... and here is what is being presented on the PC which DOES NOT WORK:
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.3 (TLS/1.2) Random: 58 17 97 37 8C 71 81 A2 0F 25 5F BE 3F D1 37 8D B8 4C 4F D3 58 BF A5 C6 EB DE E7 C3 6B 74 5D 86 "Time":> Ciphers:
22/07/1999 9:06:32 SessionID: empty Extensions: renegotiation_info 00
server_name xxxx.cloudapp.net elliptic_curves secp256r1 [0x17], secp384r1 [0x18] ec_point_formats uncompressed [0x0]
signature_algs sha256_rsa, sha384_rsa, sha1_rsa, sha256_ecdsa, sha384_ecdsa, sha1_ecdsa, sha1_dsa [003C] TLS_RSA_WITH_AES_128_CBC_SHA256 [002F] TLS_RSA_AES_128_SHA [003D] TLS_RSA_WITH_AES_256_CBC_SHA256 [0035] TLS_RSA_AES_256_SHA [0005] SSL_RSA_WITH_RC4_128_SHA [000A] SSL_RSA_WITH_3DES_EDE_SHA [C027] TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 [C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA [C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA [C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [C023] TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 [C02C] TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 [C024] TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 [C009] TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA [C00A] TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA [0040] TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 [0032] TLS_DHE_DSS_WITH_AES_128_SHA [006A] TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 [0038] TLS_DHE_DSS_WITH_AES_256_SHA [0013] SSL_DHE_DSS_WITH_3DES_EDE_SHA [0004] SSL_RSA_WITH_RC4_128_MD5
Compression: [00] NO_COMPRESSION
I suppose has something to do with the ciphers been negotiated, but will like to make w7 use tls1.2 (I check options in IE show "use Tls1.2", also instaled the registry settings to enable tls 1.2 in w7 :
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client] "DisabledByDefault"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server] "DisabledByDefault"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client] "DisabledByDefault"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server] "DisabledByDefault"=dword:00000000
any suggestions? thanks