147

I need to use TLS 1.2 to connect from my .NET web service to another that is going to force TLS 1.2. I found a resource that said .NET 4.6 uses TLS 1.2 by default so that sounded like the easiest solution. I updated the .NET framework on the server and restarted. In IIS I tried to make an application pool using .NET 4.6 but 4.0 was the only option. Then I found something that said it would still say 4.0 because 4.6 is an "in place" update to .NET 4.0. So I thought maybe I was done. However on an error page that I got for unrelated reasons, it said Microsoft .NET Framework Version:4.0.30319 so it seems I have not successfully upgraded. Any pointers on how to make sure my application pool is using .NET 4.6, or more generally how to enable TLS 1.2?

1

7 Answers 7

194
+100

We actually just upgraded a .NET web service to 4.6 to allow TLS 1.2.

What Artem is saying were the first steps we've done. We recompiled the framework of the web service to 4.6 and we tried change the registry key to enable TLS 1.2, although this didn't work: the connection was still in TLS 1.0. Also, we didn't want to disallow SLL 3.0, TLS 1.0 or TLS 1.1 on the machine: other web services could be using this; we rolled-back our changes on the registry.

We actually changed the Web.Config files to tell IIS: "hey, run me in 4.6 please".

Here's the changes we added in the web.config + recompilation in .NET 4.6:

<system.web>
    <compilation targetFramework="4.6"/> <!-- Changed framework 4.0 to 4.6 -->

    <!--Added this httpRuntime -->
    <httpRuntime targetFramework="4.6" />

    <authentication mode="Windows"/>
    <pages controlRenderingCompatibilityVersion="4.0"/>
</system.web>

And the connection changed to TLS 1.2, because IIS is now running the web service in 4.6 (told explicitly) and 4.6 is using TLS 1.2 by default.

19
165

Add the following code before you instantiate your web service client:

System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

Or for backward compatibility with TLS 1.1 and prior:

System.Net.ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls12; 
13
  • 2
    Yeah I'm already doing that, but the error message still indicates .NET 4.0.
    – nasch
    Jul 29, 2017 at 18:54
  • 13
    That is your CLR version. The .Net CLR has two versions, 2.0 and 4.0. In IIS you specify the CLR version, not the Framework version. IIS won't tell you .Net 4.6 because it doesn't care about that. If you compiled using 4.6, then you are using 4.6.
    – user47589
    Aug 1, 2017 at 14:20
  • 4
    TLS 1.2 is supported from .NET 4.5 onwards Jul 30, 2018 at 19:29
  • 6
    In this case, |= is superior to just =. They're binary flags, don't overwrite everything else unnecessarily.
    – Izzy
    Sep 6, 2018 at 9:09
  • 2
    @JohnWu - please note Izzy's comment above. Your code tells .NET to explicitly ONLY use TLS 1.2 when connecting to HTTPS resources. I.e. if a server only had TLS 1.1, your code would stop it from connecting since it's only using TLS 1.2. You should use |= to tell your code "try to use TLS 1.2 as an option too" when the client and server negotiate which protocol to use. Nov 5, 2018 at 1:00
38

if you're using .Net earlier than 4.5 you wont have Tls12 in the enum so state is explicitly mentioned here

ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;
2
  • Thank you. This helped me out. For anyone researching I was attempting to create a new folder in AzureFileStorage: fileDirectory.CreateIfNotExists(); The fileDirectory is a CloudFileDirectory object. I simply placed ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072; before that and it worked like a charm. Thanks again. Dec 13, 2020 at 20:32
  • That means .Net 4.5 on the machine, not that your application targeted compilation for 4.5. It's the operating system that supports TLS 1.2, but the application still has to allow it to be used through the SecurityProtocol setting.
    – Suncat2000
    Oct 27, 2021 at 14:29
23

Three steps needed:

  1. Explicitly mark SSL2.0, TLS1.0, TLS1.1 as forbidden on your server machine, by adding Enabled=0 and DisabledByDefault=1 to your registry (the full path is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols). See screen for details registry

  2. Explicitly enable TLS1.2 by following the steps from 1. Just use Enabled=1 and DisabledByDefault=0 respectively.

NOTE: verify server version: Windows Server 2003 does not support the TLS 1.2 protocol

  1. Enable TLS1.2 only on app level, like @John Wu suggested above.

    System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

Hope this guide helps.

UPDATE As @Subbu mentioned: Official guide

4
  • 2
    Official reference - technet.microsoft.com/en-us/library/…
    – Subbu
    Aug 1, 2017 at 15:39
  • Hi @Artem after adding the tls do i need to restart the server? Nov 26, 2018 at 15:00
  • @Simba you probably solved this, but doing this just now I did NOT need to restart the server.
    – Matt N.
    Feb 19, 2020 at 18:17
  • Nothing worked but this. Thanks May 30, 2022 at 13:18
9

For me below worked:

Step 1: Downloaded and installed the web Installer exe from https://www.microsoft.com/en-us/download/details.aspx?id=48137 on the application server. Rebooted the application server after installation was completed.

Step 2: Added below changes in the web.config

<system.web>
    <compilation targetFramework="4.6"/> <!-- Changed framework 4.0 to 4.6 -->
    <!--Added this httpRuntime -->
    <httpRuntime targetFramework="4.6" />
</system.web>

Step 3: After completing step 1 and 2, it gave an error, "WebForms UnobtrusiveValidationMode requires a ScriptResourceMapping for 'jquery'. Please add a ScriptResourceMapping named jquery(case-sensitive)" and to resolve this error, I added below key in appsettings in my web.config file

<appSettings>
      <add key="ValidationSettings:UnobtrusiveValidationMode" value="None" />
</appSettings>
1
  • Adding the httpRuntime target framework worked for me. Apr 4, 2020 at 20:24
1

Updating the server with .Net 4.6 or later will use TLS 1.2.

Found this out through troubleshooting some failed email issues with one of our console applications.

The server only had .Net 4.5 installed, and emails were failing.

On my local workstation, i had .Net 4.6, and when running the console app, the emails weren't failing.

So we moved the console app to a server that had .Net 4.6, didn't change anything else, and the emails were working again.

2
  • Is this different from the accepted answer?
    – nasch
    Nov 4, 2021 at 23:08
  • Yes it is, because we didn't have to make any code changes, or any changes to the web.config file, no need to recompile anything. But thanks for checking just in case. 😉
    – Bryan
    Nov 5, 2021 at 3:11
0

PowerBI Embedded requires TLS 1.2.

The answer above by Etienne Faucher is your solution. quick link to above answer... quick link to above answer... ( https://stackoverflow.com/a/45442874 )

PowerBI Requires TLS 1.2 June 2020 - This Is your Answer - Consider Forcing your IIS runtime to get up to 4.6 to force the default TLS 1.2 behavior you are looking for from the framework. The above answer gives you a config change only solution.

Symptoms: Forced Closed Rejected TCP/IP Connection to Microsoft PowerBI Embedded that just shows up all of a sudden across your systems.

These PowerBI Calls just stop working with a Hard TCP/IP Close error like a firewall would block a connection. Usually the auth steps work - it is when you hit the service for specific workspace and report id's that it fails.

This is the 2020 note from Microsoft PowerBI about TLS 1.2 required

PowerBIClient

methods that show this problem

GetReportsInGroupAsync GetReportsInGroupAsAdminAsync GetReportsAsync GetReportsAsAdminAsync Microsoft.PowerBI.Api HttpClientHandler Force TLS 1.1 TLS 1.2

Search Error Terms to help people find this: System.Net.Http.HttpRequestException: An error occurred while sending the request System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.