{"id":567,"date":"2017-03-31T19:27:28","date_gmt":"2017-03-31T19:27:28","guid":{"rendered":"http:\/\/99c5e07b4d5de9d18c350cdf64c5aa3d"},"modified":"2017-09-21T15:48:22","modified_gmt":"2017-09-21T07:48:22","slug":"windows-7windows-2008-tls1-2-net","status":"publish","type":"post","link":"https:\/\/www.xiaobo.li\/notes\/archives\/567","title":{"rendered":"windows 7\/windows 2008\/ tls1.2 \/ .net"},"content":{"rendered":"

<\/p>\n

\nDisable RC2 RC4 And SSL 2.0
\n<\/h2>\n

\nhttps:\/\/support.microsoft.com\/en-us\/help\/245030\/how-to-restrict-the-use-of-certain-cryptographic-algorithms-and-protocols-in-schannel.dll<\/p>\n\n\n\n
 Windows Registry Editor Version 5.00<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols]<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\SSL 2.0]<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\SSL 2.0\\Client]
\n\"DisabledByDefault\"=dword:00000001
\n\"Enabled\"=dword:00000000<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\SSL 2.0\\Server]
\n\"Enabled\"=dword:00000000
\n\"DisabledByDefault\"=dword:00000001<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\SSL 3.0]<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\SSL 3.0\\Client]
\n\"Enabled\"=dword:00000000
\n\"DisabledByDefault\"=dword:00000001<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\SSL 3.0\\Server]
\n\"Enabled\"=dword:00000000
\n\"DisabledByDefault\"=dword:00000001<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.0]<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.0\\Client]
\n\"Enabled\"=dword:00000001
\n\"DisabledByDefault\"=dword:00000000<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.0\\Server]
\n\"Enabled\"=dword:00000001
\n\"DisabledByDefault\"=dword:00000000<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.1]<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.1\\Client]
\n\"DisabledByDefault\"=dword:00000000
\n\"Enabled\"=dword:00000001<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.1\\Server]
\n\"DisabledByDefault\"=dword:00000000
\n\"Enabled\"=dword:00000001<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.2]<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.2\\Client]
\n\"DisabledByDefault\"=dword:00000000
\n\"Enabled\"=dword:00000001<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.2\\Server]
\n\"Enabled\"=dword:00000001
\n\"DisabledByDefault\"=dword:00000000<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/p>\n\n\n\n
 Windows Registry Editor Version 5.00<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers]<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 128\/128]
\n\"Enabled\"=dword:00000000<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 64\/128]
\n\"Enabled\"=dword:00000000<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 56\/128]
\n\"Enabled\"=dword:00000000<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 40\/128]
\n\"Enabled\"=dword:00000000<\/p>\n

\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 128\/128]
\n\"Enabled\"=dword:00000000<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 56\/128]
\n\"Enabled\"=dword:00000000<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 40\/128]
\n\"Enabled\"=dword:00000000<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/p>\n\n\n\n\n\n\n
\n

Protocol <\/b><\/p>\n<\/td>\n

\n

KEA <\/b><\/p>\n<\/td>\n

\n

SYM (bit) <\/b><\/p>\n<\/td>\n

\n

HSH (bit) <\/b><\/p>\n<\/td>\n

\n

CipherSuite <\/b><\/p>\n<\/td>\n<\/tr>\n

\n

TLS1.0 <\/p>\n<\/td>\n

\n

RSAKeyX <\/p>\n<\/td>\n

\n

AES (128) <\/p>\n<\/td>\n

\n

SHA1 (160) <\/p>\n<\/td>\n

\n

TLS_RSA_WITH_AES_128_CBC_SHA     <\/p>\n<\/td>\n<\/tr>\n

\n

SSL3.0 <\/p>\n<\/td>\n

\n

RSAKeyX <\/p>\n<\/td>\n

\n

RC4 (128) <\/p>\n<\/td>\n

\n

SHA1 (160) <\/p>\n<\/td>\n

\n

SSL_RSA_WITH_RC4_128_SHA <\/p>\n<\/td>\n<\/tr>\n

\n

SSL2.0 <\/p>\n<\/td>\n

\n

RSAKeyX <\/p>\n<\/td>\n

\n

RC4 (128) <\/p>\n<\/td>\n

\n

MD5 (128) <\/p>\n<\/td>\n

\n

SSL_CK_RC4_128_WITH_MD5 <\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\nTLS 1.2 and Microsoft.Net
\n<\/h2>\n
\nNow lets focus on using TLS 1.2 in .Net world. We need to make sure that
\n the web sites are served via TLS 1.2 protocol and client apps which are
\n consuming the same need to support TLS 1.2. .Net is running on top of
\noperating system and mostly its windows. If host windows supports TLS
\n1.2 .Net can also support TLS 1.2 as it relies on schannel.dll1<\/sup><\/div>\n
\n\n<\/div>\n
\nThe first task here is to make sure we are using the right tools and technologies.<\/div>\n
\n
\n

\n
\nTLS 1.2 and .Net Framework 4.5
\n<\/h2>\n<\/div>\n<\/div>\n
\n
\n.Net is also versioned. Versions below 4.5*doesn't know how to
\ncommunicate via TLS 1.2.In .Net 4.5 the TLS 1.2 is enabled
\nby default.
\nSimply compile our applications in ,Net 4.5 and we will get TLS 1.2
\ncommunication for our applications.<\/div>\n
\n

\n
\nHow to make .Net 4.0 app talk using TLS 1.2
\n<\/h2>\n
\n
\nTechnically speaking just recompile existing older application to .Net
\n4.5 to get TLS 1.2 support. It sounds simple as everybody expecting that
\n there are no breaking changes in .Net 4.5 and our application will
\nfunction as is. But if we are serious about delivering quality software
\nwe also need to test entire app in 4.5 before shipping. It really adds
\ncost.<\/p>\n

Lets see if there are any ways to use TLS 1.2 by .Net 4.0 apps.<\/p>\n

\nSystem.dll overwrite<\/h3>\n
\nWhen we install .Net 4.5 its basically adding changes on top of .Net
\n4.0. In other words the System.dll used for 4.0 apps will be overwritten
\n to 4.5 version of System.dll. So there are possibilities that .Net 4.0
\napps will execute 4.5 code when they access functions in System.dll.
\nWhich means if we have .Net 4.5 installed in the machine where our .Net
\n4.0 is running it can take advantage of TLS1.2. All our solutions below
\nare depending on this factor.<\/div>\n
\n\n<\/div>\n
\nBelow links explains the .Net versioning and overwriting.<\/div>\n
\nhttp:\/\/blogs.msdn.com\/b\/rodneyviana\/archive\/2014\/12\/23\/identifying-the-net-version-you-are-running-2-0-4-5-4-5-1-or-4-5-2.aspx<\/a><\/div>\n
\nhttps:\/\/weblog.west-wind.com\/posts\/2012\/Mar\/13\/NET-45-is-an-inplace-replacement-for-NET-40<\/a><\/div>\n

\n
\n1.Code change in 4.0 to use TLS 1.2
\n<\/h3>\n

\nNow its the matter of changing the default protocol used by 4.0 to TLS
\n1.2. This can be done by forcefully changing the  protocol as below.<\/p>\n

\/\/SecurityProtocolType.Tls1.2;<\/span><\/pre>\n
ServicePointManager<\/span>.SecurityProtocol = (SecurityProtocolType<\/span>)3072; <\/p>\n
 <\/span><\/pre>\n
System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 
\n| SecurityProtocolType.Tls11  
\n| SecurityProtocolType.Tls; <\/p>\n
\/\/ comparable to modern browsers 
\nvar request = WebRequest.Create(\"https:\/\/www.howsmyssl.com\/a\/check\");
\nvar response = request.GetResponse();  
\nvar body = new StreamReader(response.GetResponseStream()).ReadToEnd(); <\/p>\n

\nIf we look at the SecurityProtocolType enum for .Net 4.0, we will not be able to see the TLS1.2. But in 4.5 we can see that. So .Net 4.0 will not compile if we use TLS1.2 enum value. But if we use the TLS1.2 enum number it will compile and at runtime since the .Net 4.0's System.dll is replaced with 4.5 the cast will work. <\/span> <\/p>\n
 <\/span><\/pre>\n
Please note that this will fail if we are running the same app in a machine which don't have 4.5 installed. Recommended only for servers where its easy to manage the .Net version.<\/span><\/pre>\n
\n
\n2.Registry change to force .Net 4.0 to use TLS 1.2
\n<\/h3>\n
\nIf we inspect the .Net 4.5 ServicePointManager source code<\/a> we can see that the default protocol is depending on the below registry entry.<\/p>\n
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319
\n    SchUseStrongCrypto to DWORD 1
\n<\/i><\/p>\n
The default value will be 0. Simply change this to 1 to get .Net 4.5
\nSystem.dll use TLS 1.2. Since our 4.0 application uses 4.5 System.dll
\n4.0 gets TLS 1.2 support.<\/p>\n
http:\/\/stackoverflow.com\/questions\/28286086\/default-securityprotocol-in-net-4-5<\/a><\/div>\n<\/div>\n
\n
\nReferences
\n<\/h2>\n
\nhttps:\/\/www.owasp.org\/index.php\/Transport_Layer_Protection_Cheat_Sheet#Client_.28Browser.29_Configuration
\nhttps:\/\/www.simple-talk.com\/dotnet\/.net-framework\/tlsssl-and-.net-framework-4.0\/
\nhttps:\/\/msdn.microsoft.com\/en-us\/library\/system.security.authentication.sslprotocols(v=vs.110).aspx
\nhttps:\/\/istlsfastyet.com\/
\nhttp:\/\/blogs.msdn.com\/b\/benjaminperkins\/archive\/2014\/11\/04\/using-tls-1-2-with-wcf.aspx
\nhttp:\/\/blogs.msdn.com\/b\/benjaminperkins\/archive\/2011\/10\/07\/secure-channel-compatibility-support-with-ssl-and-tls.aspx
\nhttp:\/\/www.dotnetnoob.com\/2013\/10\/hardening-windows-server-20082012-and.html<\/p>\n
TLS Cipher Suites in Windows 7<\/b>
\nhttps:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/mt767780%28v=vs.85%29.aspx
\nTLS Cipher Suites in Windows 8<\/b>
\nhttps:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/mt762882%28v=vs.85%29.aspx
\nTLS Cipher Suites in Windows 8.1<\/b>
\nhttps:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/mt767781%28v=vs.85%29.aspx
\nTLS Cipher Suites in Windows 10 v1507<\/b>
\nhttps:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/mt767769%28v=vs.85%29.aspx
\nTLS Cipher Suites in Windows 10 v1511<\/b>
\nhttps:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/mt767768%28v=vs.85%29.aspx
\nTLS Cipher Suites in Windows 10 v1567<\/b>
\nhttps:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/mt490158%28v=vs.85%29.aspx<\/p>\n
\nTools
\n<\/h2>\n
\nfor .net framework 4.5
\nSSLTLSCheck.zip<\/a><\/span><\/p>\n
\"\u70b9\u51fb\u67e5\u770b\u539f\u56fe\"<\/a><\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\nTLS 1.2 and Microsoft.Net
\n<\/h2>\n
\nNow lets focus on using TLS 1.2 in .Net world. We need to make sure that
\n the web sites are served via TLS 1.2 protocol and client apps which are
\n consuming the same need to support TLS 1.2. .Net is running on top of
\noperating system and mostly its windows. If host windows supports TLS
\n1.2 .Net can also support TLS 1.2 as it relies on schannel.dll1<\/sup><\/div>\n
\n<\/div>\n
\nThe first task here is to make sure we are using the right tools and technologies.<\/div>\n
\n
\n
\nTLS 1.2 and .Net Framework 4.5
\n<\/h2>\n<\/div>\n<\/div>\n
\n.Net is also versioned. Versions below 4.5*doesn't know how to
\ncommunicate via TLS 1.2.In .Net...<\/div>\n
 \u7ee7\u7eed\u9605\u8bfb →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[279],"tags":[],"class_list":["post-567","post","type-post","status-publish","format-standard","hentry","category-dotnet"],"_links":{"self":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts\/567","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/comments?post=567"}],"version-history":[{"count":0,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts\/567\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/media?parent=567"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/categories?post=567"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/tags?post=567"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}