0

I read this post about security protocol configuration in .NET - Great stuff, got me unstuck.

This post is a TL;DR, generic version of the specific issue I am having in the linked post.

My question is, is it possible to configure an ASP.NET application such that it is protocol agnostic?

In the short term, I can add this line 

System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls | System.Net.SecurityProtocolType.Tls11 | System.Net.SecurityProtocolType.Tls12;

to get my code working for clients committed to TLS only, but in the future I will need to update this whenever a new protocol comes out. It's hard-coded, which is smelly

As I understand it, adding values to the ServicePointManager.SecurityProtocol collection configures .NET in such a way that it will attempt to renegotiate connections if one protocol fails. I would like it to fall back on the server configuration.

In other words, how can I/is it possible to configure my ASP.NET application such that it will respect the security protocol configuration established by the registry keys that IISCrypto looks at?

Community
  • 1
  • 1
Matt
  • 1,674
  • 2
  • 16
  • 34
  • Frankly, the whole idea sounds bad to me. One major security hole in networked code today is endpoints that are willing to fall back to a less-secure protocol when the remote endpoint claims to not know the latest version. Why would you intentionally implement that vulnerability? As for the question itself, it seems overly broad to me; the answer to almost every "is it possible?" question in programming is "yes" (given enough effort). Your question would be better received if you'd show what you tried (with a [mcve]) and explain what _specific_ problem you can't solve yourself. – Peter Duniho Apr 27 '16 at 02:22
  • This post is a TL;DR of a specific example of the issue I was having (in the post that was linked). I've updated the post to more clearly reflect that. – Matt Apr 27 '16 at 13:37

1 Answers1

0

I found a solution that removes the responsibility of security protocol configuration from our code and moves it to the registry.

The necessary change is adding the "SchUseStrongCrypto"=dword:00000001 Value to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 Key.

enter image description here

Now it is on our clients who consume this code to properly configure their environment's security protocol, and there is no need to hard-code anything into the ServicePointManager.SecurityProtocol collection.

Community
  • 1
  • 1
Matt
  • 1,674
  • 2
  • 16
  • 34