How to use TLS 1.2 in ASP.NET Core 2.0

Question

My salesforce res apis were working fine until. When suddenly I started getting authentication errors. retry your request. Salesforce.Common.AuthenticationClient.d__1.MoveNext().

salesforce informed that it would use from now TLS .1.2. How can I enforce my asp.net core 2.0 to use TLS 1.2 in Startup.cs. below is my code for login.

 private async Task<AuthenticationClient> GetValidateAuthentication()
        {
            RestApiSetting data = new RestApiSetting(Configuration);
            var auth = new AuthenticationClient();
            var url = data.IsSandBoxUser.Equals("true", StringComparison.CurrentCultureIgnoreCase)
                ? "https://test.salesforce.com/services/oauth2/token"
                : "https://login.salesforce.com/services/oauth2/token";
            try
            {
                //ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
                await auth.UsernamePasswordAsync(data.ConsumerKey,
                data.ConsumerSecret, data.Username, data.Password, url);
                return auth;
            }
            catch (Exception ex)
            {
                throw new Exception(ex.ToString());
            }
        }

maybe this can help https://stackoverflow.com/questions/46832384/any-way-to-restrict-asp-net-core-2-0-https-to-tls-1-2 — Guruparan Giritharan, Mar 21 '18 at 06:04
For .net i used to run a registry entry there should be a similar way for .net core check the below page for the .net one https://help.salesforce.com/articleView?id=000221207&type=1 — Guruparan Giritharan, Mar 21 '18 at 06:10
The strange bit is sometimes the authentication works sometimes it doesnot — maxspan, Mar 21 '18 at 06:25
I think .Net Core automatically uses TLS 1.2, so unline standard .Net you do not need the: System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12; To make WebClient support/user TLS 1.2 — nivs1978, Nov 21 '18 at 10:08

score 20 · Answer 1 · answered Oct 30 '18 at 01:58

.net framework prior to version 4.7 makes outbound connections using TLS 1.0 by default. You can upgrade to a newer version to fix the problem, or alternatively, you can set the default and fallback versions for outbound calls using the ServicePointManager, or passing the setting into the HttpClient if you have the source code for the library.

Add the following somewhere early in your pipeline, such as your startup.cs or global.asax:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;

You can find a good description on the topic here: https://social.msdn.microsoft.com/Forums/en-US/8db54c83-1329-423b-8d55-4dc6a25fe826/how-to-make-a-web-client-app-use-tls-12?forum=csharpgeneral

And if you want to specify it only for some requests instead of application-wide, then you can customize the HttpClientHandler of your HttpClient:

var handler = new HttpClientHandler
{
    SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls
};

HttpClient client = new HttpClient(handler);
...

A note to others coming with 4.6.1 targeting issues where you may be dragging in deps to .netstandard as a result of other nuget packages. `ServicePointManager.SecurityProtocol` does not seem to work in some cases (due to binding conflict/resolution issue). Setting `HttpClientHandler.SslProtocols` explicitly and passing to `HttpClient` resolved this for me. — Andrew, Nov 27 '20 at 10:06

score 5 · Answer 2 · answered Jan 18 '19 at 16:43

5

According to the following https://github.com/dotnet/corefx/issues/29452

In .NET Core, ServicePointManager affects only HttpWebRequest. It does not affect HttpClient. You should be able to use HttpClientHandler.ServerCertificateValidationCallback to achieve the same.

answered Jan 18 '19 at 16:43

G.Q. Luo

71
1
2

Then using Alexandru Puiu's method of customizing the handler for a specific HttpClient should work right? – Anders Emil Jun 14 '20 at 08:51
ServerCertificateValidationCallback validates the certificate, SslProtocols sets the version of TLS to be used – Alexandru Puiu Apr 21 '21 at 19:50

How to use TLS 1.2 in ASP.NET Core 2.0

2 Answers2

Linked