“无法创建SSL / TLS安全通道”：克隆如何工作？

Question

We suddenly started seeing this " Could not create SSL/TLS secure channel " error.

• Our website does a simple POST to another server to a HTTPS URL
• This suddenly stopped working
• Nothing has changed (Windows Updates, our updates, server settings) to cause suspicion. That we know of, or can remember.
• We can navigate to the posted URL just fine.

We have other websites that also do this same POST to that same server and they continue to work. Everything is using TLS 1.0 and the target server has not changed anything recently. Nobody has turned off TLS 1.0 on either side.

This issue is discussed in many other stackoverflow postings, so to research systematically we made a clone of the website on the same server. Just copied its code (compiled code folders) and set up another virtual host in the same IIS.

The POST operation from the clone works! Same server, same code, same IIS. So we can't even reproduce it on the exact same setup. The copy is working but the original is throwing this error.

So finally the question: Does the fact that the copied website can POST successfully give anybody any insight into what may have happened?

Could some IIS settings on the original site been changed? The only thing different is they are two virtual hosts on the same server.

Windows Server 2012R2, IIS 8.5, ASP.NET/C#.

Answer 1

I found the solution here: https://social.technet.microsoft.com/Forums/en-US/9dfb4d09-8096-40c9-ac75-1e23f75417c9/frequent-event-id-36888-windows-schannel-errors-in-the-event-viewer?forum=W8ITProPreRel

The causes can be many, apparently, even Windows updates. Still seems odd that it would happen (consistently) on one website and not on its clone (also consistently).

The specific steps to fix were: In Group Policy Editor (run: gpedit.msc), went to Computer Configuration > Administrative Templates > System > Distributed COM > Application Compatibility and enabled "allow local activation security check exemptions"