Why is the value of ServicePointManager.SecurityProtocol differently different on different machines?

Question

I currently have a problem and cannot find a strict answer.

I have ASP.NET MVC 5 for targeting 4.6.1 applications, and its goal is to work with a third-party API that is protected by the TLS 1.1 / TLS 1.2 protocols.

I tried to run the application in two environments:

• my local Windows 10 machine with .NET 4.6.2 Framework, IIS Express;
• Windows Server 2012 Server Server with .NET 4.6.1, IIS 8.0

The problem is that when starting the ServicePointManager.SecurityProtocol locally, the default value is set to Ssl3, Tls , so I can’t configure the target API and have to encode it when the application starts to use TLS 1.1 / TLS 1.2: ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12 ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12 .

When the application runs on the server, the default value of ServicePointManager.SecurityProtocol set to Tls, Tls11, Tls12 , so it works well.

According to documentation applications running in the .NET Framework 4.6 or later, you must use TLS 1.1 / TLS 1.2 by default, as is done on the remote machine.

Why are the default values ​​of ServicePointManager.SecurityProtocol different? Is this because of the .NET Framework configuration? Or maybe registry settings? I looked through it, but could not find the answer.

Answer 1

MSDN: property ServicePointManager.SecurityProtocol :

Note that no default value is specified for this property. The security landscape is constantly changing, and by default, protocols and security levels change over time to avoid known weaknesses. The default values ​​will vary depending on the configuration of individual computers and on which software is installed and on which patches were applied.

MSDN Blogs: Support for SSL / TLS on Windows :

On Windows, SSL / TLS protocol support is bound to the SCHANNEL component. Thus, if a particular OS version does not support the SSL / TLS version, this means that it remains unsupported.

MSDN: Cipher Suites at TLS / SSL (Schannel SSP)

Different versions of Windows support different types of TLS encryption and priority order. See the appropriate version of Windows for the standard order in which they are selected by Microsoft Schannel.

In other words: this is determined by your version of Windows and its level of fix.

But as @Damien said, why are you worried about what the default level is?

Answer 2

We can update the registry as shown below to allow the .Net infrastructure to use TLS1.1 \ TLS1.2, a restart is required.

I tried and the value of ServicePointManager.SecurityProtocol in my machine changed from "Ssl3, Tls" to "Tls, Tls11, Tls12":

 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319] "SchUseStrongCrypto"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319] "SchUseStrongCrypto"=dword:00000001