WinHttp errors on option 9 / Win2008 / Classic ASP

Question

The Server I am connecting to requires TLS 1.1. My attempts fail. I am on a Windows Server 2008 R2 Standard SP1 64bit machine using Classic ASP.

Here is my code:

const WinHttpRequestOption_SecureProtocols = 9

const SecureProtocol_TLS1_1 = 512

dim objHTTP

set objHTTP = CreateObject("WinHttp.WinHttpRequest.5.1")

No error:

objHTTP.Option(9) = 128

'No error:

objHTTP.Option(9) = &H80

'Errors right here:

objHTTP.Option(WinHttpRequestOption_SecureProtocols) = SecureProtocol_TLS1_1

'Errors right here:

objHTTP.Option(9) = 512

'Errors right here:

objHTTP.Option(9) = &H200

It does not matter where in the code I place this line, I still get this error as it tries to execute:

Microsoft VBScript runtime error '800a0005'

Invalid procedure call or argument: 'Option'

My Server's Browser was IE8, so I installed IE11 hoping for better results. Same error.

I have the Internet options of IE11 set to

(Unchecked) Use SSL 2.0
(Unchecked) Use SSL 3.0
(Unchecked) Use TLS 1.0
(Checked) Use TLS 1.1
(Checked) Use TLS 1.2

In the Registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\

I have TLS 1.1 and 1.2 set at enabled=1 and DisabledByDefault=0

All the rest are set opposite.

I did the same at /ControlSet001/ and /ControlSet002/

Why can't I set objHTTP.Option(9) = 512?
Bonus question: Why is WinHttp insisting on TLS 1.0 regardless of my Server's settings?

Thanks for the suggestion. These are the only values I can use for Option(9) that do not error out: 8 32 40 128 136 160 168 — user3593080, Aug 10 '15 at 16:18
See this duplicate question https://stackoverflow.com/questions/34997849/classic-asp-outbound-tls-1-2/39170683#39170683 — Henrik Høyer, Oct 14 '19 at 16:49

score 2 · Answer 1 · edited May 23 '17 at 11:46

This option means TLS 1.0:

objHTTP.Option(9) = 128

And winhttp.dll library on Windows 2008 R2 has reference only to this value. That's why you don't have any error with it.

Next option means TLS 1.1:

objHTTP.Option(9) = 512

But only Windows 2012 and newer knows this value. That's why you have errors on Windows 2008 R2

So you have to upgrade your Windows in order to use this setting.

Or there is another approach using registry fix exists. Because Windows uses this value in case it is not specified in your code.

This approach works without changing any line of code.

In general:

Register protocol TLS 1.1 or even 1.2 is better (or both) in next section

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
Tell winhttp.dll to use one of those protocols by default with value "DefaultSecureProtocols" in next sections

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]

See more details in my answer here: Classic ASP Outbound TLS 1.2

score 1 · Answer 2 · edited Oct 06 '15 at 18:47

1

If you open the winhttp.dll in visual studio object browser, the version in Windows Server 2008 does not contain the constants for TLS1.1 and TLS1.2 under WinHttpRequestSecureProtocols enum.

If you do the same for Windows Server 2012, you'll find that the constants for TLS1.1 and TLS1.2 do appear.

I don't see an update available for Win 2008 to upgrade winhttp. If one exists I'd like to know. I haven't tried copying the Win 2012 version to Win 2008. I don't know if that would cause issues or not.

edited Oct 06 '15 at 18:47

Erik Kaplun

37,128
15
99
111

answered Oct 05 '15 at 15:44

ISAslot

11
2

Would there be any issue if we are trying to transfer winhttp.dll from windows 2012 to windows 2008 and register it on 2008 ? – Raihan Nov 02 '15 at 21:29

WinHttp errors on option 9 / Win2008 / Classic ASP

2 Answers2

Linked