.net - 如何为 Amazon Simple Email Service 启用 TLS 1.1/1.2

Question

多年来，我一直使用 Amazon-SES 成功发送电子邮件。但是，出于 PCI 合规性原因，我们一直在尝试禁用 TLS 1.0:

System.Net.ServicePointManager.SecurityProtocol = 
    SecurityProtocolType.Tls11 | 
    SecurityProtocolType.Tls12;

但是，这会在尝试发送 EMail 时导致异常:

AuthenticationException:
    A call to SSPI failed, see inner exception.
    The client and server cannot communicate, because they do not 
    possess a common algorithm

只要我重新添加 SecurityProtocolType.Tls，它就会再次成功。.NET 4.5 和 4.6 都会发生。使用 AWSSDK-SimpleEmail (v3.1.1.1) & AWSSDK-Core Runtime (v3.1.2.1)

Answer 1

回答我自己的问题:
我们启用了 TLS 1.0 客户端，禁用了 TLS 1.0 服务器。这让 SSLLabs 和 PCI 检查很愉快，同时仍然允许我们连接到 Amazon SES 以发送电子邮件。这是我们使用的代码:

    private static Tuple<string, string, bool>[] s_ProtocolConfig = 
    {
        Tuple.Create("SSL 2.0", "client", false),
        Tuple.Create("SSL 2.0", "server", false),
        Tuple.Create("SSL 3.0", "client", false),
        Tuple.Create("SSL 3.0", "server", false),
        Tuple.Create("TLS 1.0", "client", true),    // Leave this to TRUE, so that we can send outgoing email.
        Tuple.Create("TLS 1.0", "server", false),   // Change this to disable incoming 1.0 TLS requests
        Tuple.Create("TLS 1.1", "client", true),
        Tuple.Create("TLS 1.1", "server", true),
        Tuple.Create("TLS 1.2", "client", true),
        Tuple.Create("TLS 1.2", "server", true),
    };

    /// <summary>
    /// Disable/Enable Protocole
    /// require a reboot if the values are changed.
    /// </summary>
    private static bool ConfigureProtocols(IEnumerable<Tuple<string, string, bool>> config)
    {
        bool rebootRequired = false;
        using (RegistryKey protocols = Registry.LocalMachine.OpenSubKey(@"SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols", true))
        {
            foreach (Tuple<string, string, bool> proto in config)
            {
                string protocol = proto.Item1;
                string clientServer = proto.Item2;
                bool enabled = proto.Item3;

                using (RegistryKey group = protocols.CreateSubKey(protocol))
                {
                    bool added = group.OpenSubKey(clientServer) == null;

                    using (RegistryKey newKey = group.CreateSubKey(clientServer))
                    {
                        bool updated = EnsureValue(newKey, "disabledbydefault", !enabled);
                        updated |= EnsureValue(newKey, "enabled", enabled);
                        newKey.Close();

                        if (!added && updated)
                        {
                            // the values have changed. Reboot is required to have them be reflected
                            rebootRequired = true;
                        }
                        if (added && !enabled)
                        {
                            // lack of added key is the same as enabled.
                            // therefore was enabled, but we need disabled = reboot required
                            rebootRequired = true;
                        }
                    }
                    group.Close();
                }
            }
            protocols.Close();
        }
        return rebootRequired;
    }

    private static bool EnsureValue(RegistryKey key, string name, bool value)
    {
        object currentValue = key.GetValue(name);
        object expectedValue = value ? 1 : 0;
        if (currentValue == null || !object.Equals(currentValue, expectedValue))
        {
            key.SetValue(name, expectedValue);
            return true;
        }
        return false;
    }