2

I have .NET 2.0 Windows Forms app that makes an HttpWebRequest to download a file from a secure HTTPS server. This has run flawlessly in test on 3-4 completely separate networks.

My client needs to run this on a very restricted, secure network. Only authorized personnel are allowed to be on that network. Our liason tester who is allowed to install and test the app reports that the it is failing with this error:

The request was aborted: Could not create SSL/TLS secure channel.

Using wireshark, he is able to see that two of the three SSL handshakes occur. Any idea why the third would not occur?

He is able to successfully hit the download link from IE and download the file, which makes me believe that permissions are set up correctly.

In my app, I have set a couple of ServicePoint properties: Expect100Continue = true and require SSL3. Also I have set the validation callback to always return true (accept all certificates). Any idea why the app can't establish and SSL connection, but IE can?

Any help debugging this would be super. Thanks.

UPDATE 3/7/2012

Added System.Net tracing and here is a piece that I found interesting. Algorithm mismatch.

Added System.Net tracing and here is a piece that I found interesting. Algorithm mismatch.

kmehta
  • 2,457
  • 6
  • 31
  • 37
  • Possible duplicate : http://stackoverflow.com/questions/2859790/the-request-was-aborted-could-not-create-ssl-tls-secure-channel – Simon Dugré Jun 28 '12 at 20:57

1 Answers1

1

I had this problem too. Cost me a lot of time... In my case I found out the server wants to check the third party's certificate with the Certificate Authority (CA). Only the CA's ip-address got blocked by the firewall. This all happens during the handshake and got me the same error message.

Marino van der Heijden
  • 528
  • 4
  • 10
  • I also face the same issue. How did you find it? which tool used? could u share the steps to the community. – kudlatiger Aug 30 '19 at 02:49
  • 1
    Not sure anymore. I believe IIS logged something about a handshake that couldn't be verified. A signed certificate can have a property named "CRL Distribution Points" which contains a URL for checking whether the certificate has been revoked. In my case this URL was blocked by the firewall since it blocked everything except whitelisted traffic. For this to find and fix I needed all the help of the system admins. – Marino van der Heijden Aug 04 '20 at 14:25