在Windows Server 2008 R2上使用IIS7.5使用TLS1.2发出请求

Question

I have a webservice made in C#. It consumes other web service, but it always use SSL3 or TLS1.0.

I have changed the registry like this link: https://www.derekseaman.com/2010/06/enable-tls-12-aes-256-and-sha-256-in.html#uds-search-results

If on the registry, i disable TLS1.0, it tries to make the request with SSL3, If i disable SSL3 it doesn't make the request. If i put the TLS1.2 ciphers only on the gpedit, it doesn't make the request. I think that TLS1.2 only works when answer a request, not when consume.

This are the suite ciphers that IIS use:

TLS 1.0:

Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004)

SSL3:

Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)

If i use a stand alone c# application, it uses TLS1.2, but when it is managed by IIS, doesn't do this.

I use .NET 3.5, running on .NET4.0 (on the properties of project, i have .NET 3.5, on the web.config, i have ). This is because i need to use WSE3. The runtime of .Net is v4.0.30319

Answer 1

To support TLS 1.1/1.2 as a client on older versions of .NET you need to enable those protocols on ServicePointManager .

But the enumeration normally used for this doesn't have the necessary fields, but the underlying values do work if the installation is fully patched. Using VB.Net (as it is code I have to hand):

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls _
                    Or DirectCast(&H300, SecurityProtocolType) _
                    Or DirectCast(&HC00, SecurityProtocolType)