无论使用TLS 1.1的.net代码如何，都使用TLS 1.2

Question

I'm trying to confirm that my application is connecting to SQL server using TLS 1.2. I am able to see that it's connecting using 1.2 using Wire Shark, but I want to confirm that when I switch back to 1.1 it shows 1.1. However, when I switch to 1.1 in my code, it still shows TLS 1.2 in Wireshark. Why is TLS 1.2 being used regardless? I'm afraid that it's always showing TLS 1.2 just for the handshake, but it's not actually connecting with TLS 1.2. It's also not showing server hello in the Windows Network Analyzer, like I read in other Stack Overflow posts. It is only showing the Client hello. Is the server hello necessary? Since it's using TDS, I'm not sure if the server hello is supposed to be there.

//when I use this code, it shows as using tls 1.2 in Wire Shark

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11;

Answer 1

Changing C# TLS versions manually to lower number sets the minimum requirement. You will be nudged up to whatever the highest version you have set up on the client machine that is making the connection. For example, if you have TLS 1.2 then setting TLS 1.1 on the C# client will not necessarily use 1.1 but rather 1.2.