Support for TLS System Default Versions included in the .NET Framework 3.5 on Windows 8.1 and Windows Server 2012 R2

Resolution

Developer Guidance

The definition of the new extensions are in the following files:
 

• SecurityProtocolTypeExtensions.csnamespace System.Net
  {
  using System.Security.Authentication;
  public static class SecurityProtocolTypeExtensions
  {
  public const SecurityProtocolType Tls12 = (SecurityProtocolType)SslProtocolsExtensions.Tls12;
  public const SecurityProtocolType Tls11 = (SecurityProtocolType)SslProtocolsExtensions.Tls11;
  public const SecurityProtocolType SystemDefault = (SecurityProtocolType)0;
  }
  }

• SslProtocolsExtensions.csnamespace System.Security.Authentication
  {
  public static class SslProtocolsExtensions
  {
  public const SslProtocols Tls12 = (SslProtocols)0x00000C00;
  public const SslProtocols Tls11 = (SslProtocols)0x00000300;
  }
  }

To include the support for TLS v1.2, include the source files in your project and then set the protocol version by using the following methods:
 

• Applications that are using ServicePointManager-based APIs can set the protocol using as follows:
  
  System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolTypeExtensions.Tls12;

• Applications that are using the SslStream AuthenticateAsClient(String, X509CertificateCollection, SslProtocols, Boolean) overload can set the SslProtocols value as SslProtocolsExtensions.Tls12.

If the registry mentioned in the first paragraph is set and in the application the SslProtocols value is set as SslProtocols.None, then the system default behavior is chosen that will depend on the Windows Operating System version.

Also when you are changing the application code to enable support for TLS v1.2 with .NET Framework 3.5 SP1 you should ensure on computers where this patch is not deployed you handle the following exceptions thrown:
 

1. If the hotfix is not installed, ServicePointManager-based APIs (HTTP, FTP, SMTP) will throw "System.NotSupportedException: The requested security protocol is not supported." when the application calls ServicePointManager.SecurityProtocol to set the new value.

2. If the hotfix is not installed, SslStream-based APIs will throw when calling either of the AuthenticateAs* APIs:

   System.ArgumentException: The specified value is not valid in the 'SslProtocolType' enumeration.
   Parameter name: sslProtocolType

Note For SslStream only, a combination of Tls12, Tls11 with any of the existing Tls, Ssl3, Ssl2 (for example: Tls12 | Tls11 | Tls) will silently downgrade to the existing protocols (for example: Tls) on a system without the patch. It will connect with Tls without throwing the exception.
 

More Information

To enable TLS v1.1 or v1.2 as operating system defaults, follow the instructions at https://technet.microsoft.com/en-us/library/dn786418(v=ws.11).aspx#BKMK_SchannelTR_TLS12.

Note TLS v1.1 and v1.2 are not available in Windows Vista or Windows Server 2008.

If you have to disable the operating system defaults set by the registry key that is mentioned earlier for specific applications it can be done by adding the following registry key:HKEY_LOCAL_MACHINE\SOFTWARE\[Wow6432Node\]Microsoft\.NETFramework\v2.0.50727\System.Net.ServicePointManager.SystemDefaultTlsVersions
<<Full path of the .exe for the file>> DWORD 0
C:\MyApp\MyApp.exe DWORD 0

For more information about TLS v1.2, see Introducing TLS v1.2.

After you enable the SystemDefaultTlsVersions .NET registry key, a different behavior occurs for each version of Windows, as shown in the following table.