c# - 当服务器响应 TLS 1.1 时，.net 4.7 无法创建 SSL channel

Question

我正在尝试使用客户端证书身份验证执行 HTTPS GET 请求，但失败了

The request was aborted: Could not create SSL/TLS secure channel.

我正在使用 Java 尝试相同的请求并且它工作正常，我在 Java 日志中看到以下内容(只删除了有趣的部分):

*** ClientHello, TLSv1.2
main, WRITE: TLSv1.2 Handshake, length = 185

....

*** ServerHello, TLSv1.1
main, READ: TLSv1.1 Handshake, length = 3339

据我了解，这意味着该服务器出于某种原因不支持 TLS 1.2，但客户端接受它并简单地回退到 TLS 1.1。

当我设置

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11;

.NET 也能正常工作。现在的问题是 - 为什么 .NET 不像 Java 那样回退到 TLS 1.1，我能否以某种方式启用该回退(无需实际尝试 TLS 1.2，捕获异常并尝试使用 TLS 1.1)？

Answer 1

在ServicePointManager.SecurityProtocol的描述中据称

Note that no default value is listed for this property, on purpose.The security landscape changes constantly, and default protocols andprotection levels are changed over time in order to avoid knownweaknesses. Defaults will vary depending on individual machineconfiguration, and on which software is installed, and on whichpatches have been applied.

Your code should never implicitly depend onusing a particular protection level, or on the assumption that a givensecurity level is used by default. If your app depends on the use of aparticular security level, you must explicitly specify that level andthen check to be sure that it is actually in use on the establishedconnection. Further, your code should be designed to be robust in theface of changes to which protocols are supported, as such changes areoften made with little advance notice in order to mitigate emergingthreats.

而在 .NET 4.7 上，此属性的默认值应为 SystemDefault ( source ) 并且 SystemDefault 表示“向操作系统询问默认协议(protocol)列表”(以及在 Windows 10 TLS 1.1 和 TLS 1.2 上是 enabled )——这个值仍然会受到多个外部源的影响(例如注册表项，正如你在上面看到的，即使是安装的软件或应用的补丁)。正如我们在评论中发现的那样，出于某种原因，您将其设置为 Ssl3 |默认情况下是 Tls，这很糟糕，因为 Ssl3 甚至不安全，应该禁用。

因此，为了解决您的问题(以及将来的此类情况)- 始终列出您需要的协议(protocol)，尤其是当您在多台客户端计算机上发布您的应用程序时，因为默认设置不可靠:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;