. net 4.0/4.5中默认的System.Net.ServicePointManager.SecurityProtocol是SecurityProtocolType.Tls|SecurityProtocolType.Ssl3。

.NET 4.0支持TLS 1.0， .NET 4.5支持TLS 1.2

然而，如果在相同的环境中安装了。net 4.5，针对. net 4.0的应用程序仍然可以支持TLS 1.2。

我通过观察fiddler4在流量中设置的正确安全协议，并在.NET 4.0项目中手动设置枚举值来验证这一点:

ServicePointManager.SecurityProtocol = (SecurityProtocolType)192 |
(SecurityProtocolType)768 | (SecurityProtocolType)3072;

参考:

namespace System.Net
{
    [System.Flags]
    public enum SecurityProtocolType
    {
       Ssl3 = 48,
       Tls = 192,
       Tls11 = 768,
       Tls12 = 3072,
    }
}

如果你试图在安装了。net 4.0的环境中进行黑客攻击，你会得到异常:

未处理异常:系统。NotSupportedException:请求的安全协议不支持。 在System.Net.ServicePointManager。set_SecurityProtocol (SecurityProtocolType v 价值)

然而，我不建议这个“黑客”，因为未来的补丁等可能会打破它

因此，我决定移除对SSLv3的支持的最佳途径是:

将所有应用程序升级到。net 4.5 在boostrapping代码中添加以下代码来覆盖默认值并在未来证明它: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType。Tls |安全协议类型。Tls11 | SecurityProtocolType.Tls12;

*如果这个黑客是错误的，有人纠正我，但初步测试我看到它工作

. net 4.0/4.5中默认的System.Net.ServicePointManager.SecurityProtocol是SecurityProtocolType.Tls|SecurityProtocolType.Ssl3。

.NET 4.0支持TLS 1.0， .NET 4.5支持TLS 1.2

然而，如果在相同的环境中安装了。net 4.5，针对. net 4.0的应用程序仍然可以支持TLS 1.2。

我通过观察fiddler4在流量中设置的正确安全协议，并在.NET 4.0项目中手动设置枚举值来验证这一点:

ServicePointManager.SecurityProtocol = (SecurityProtocolType)192 |
(SecurityProtocolType)768 | (SecurityProtocolType)3072;

参考:

namespace System.Net
{
    [System.Flags]
    public enum SecurityProtocolType
    {
       Ssl3 = 48,
       Tls = 192,
       Tls11 = 768,
       Tls12 = 3072,
    }
}

如果你试图在安装了。net 4.0的环境中进行黑客攻击，你会得到异常:

未处理异常:系统。NotSupportedException:请求的安全协议不支持。 在System.Net.ServicePointManager。set_SecurityProtocol (SecurityProtocolType v 价值)

然而，我不建议这个“黑客”，因为未来的补丁等可能会打破它

因此，我决定移除对SSLv3的支持的最佳途径是:

将所有应用程序升级到。net 4.5 在boostrapping代码中添加以下代码来覆盖默认值并在未来证明它: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType。Tls |安全协议类型。Tls11 | SecurityProtocolType.Tls12;

*如果这个黑客是错误的，有人纠正我，但初步测试我看到它工作

I'm running under .NET 4.5.2, and I wasn't happy with any of these answers. As I'm talking to a system which supports TLS 1.2, and seeing as SSL3, TLS 1.0, and TLS 1.1 are all broken and unsafe for use, I don't want to enable these protocols. Under .NET 4.5.2, the SSL3 and TLS 1.0 protocols are both enabled by default, which I can see in code by inspecting ServicePointManager.SecurityProtocol. Under .NET 4.7, there's the new SystemDefault protocol mode which explicitly hands over selection of the protocol to the OS, where I believe relying on registry or other system configuration settings would be appropriate. That doesn't seem to be supported under .NET 4.5.2 however. In the interests of writing forwards-compatible code, that will keep making the right decisions even when TLS 1.2 is inevitably broken in the future, or when I upgrade to .NET 4.7+ and hand over more responsibility for selecting an appropriate protocol to the OS, I adopted the following code:

SecurityProtocolType securityProtocols = ServicePointManager.SecurityProtocol;
if (securityProtocols.HasFlag(SecurityProtocolType.Ssl3) || securityProtocols.HasFlag(SecurityProtocolType.Tls) || securityProtocols.HasFlag(SecurityProtocolType.Tls11))
{
    securityProtocols &= ~(SecurityProtocolType.Ssl3 | SecurityProtocolType.Tls | SecurityProtocolType.Tls11);
    if (securityProtocols == 0)
    {
        securityProtocols |= SecurityProtocolType.Tls12;
    }
    ServicePointManager.SecurityProtocol = securityProtocols;
}

This code will detect when a known insecure protocol is enabled, and in this case, we'll remove these insecure protocols. If no other explicit protocols remain, we'll then force enable TLS 1.2, as the only known secure protocol supported by .NET at this point in time. This code is forwards compatible, as it will take into consideration new protocol types it doesn't know about being added in the future, and it will also play nice with the new SystemDefault state in .NET 4.7, meaning I won't have to re-visit this code in the future. I'd strongly recommend adopting an approach like this, rather than hard-coding any particular security protocol states unconditionally, otherwise you'll have to recompile and replace your client with a new version in order to upgrade to a new security protocol when TLS 1.2 is inevitably broken, or more likely you'll have to leave the existing insecure protocols turned on for years on your server, making your organisation a target for attacks.

硬编码ServicePointManager的替代方案。SecurityProtocol或上面提到的显式SchUseStrongCrypto密钥: 你可以告诉。net使用SystemDefaultTlsVersions键来使用默认的channel设置， 例如:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319] "SystemDefaultTlsVersions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319] "SystemDefaultTlsVersions"=dword:00000001

您可以覆盖以下注册表的默认行为:

Key  : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 
Value: SchUseStrongCrypto
Type: REG_DWORD
Data : 1

and

Key  : HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319
Value: SchUseStrongCrypto
Type: REG_DWORD
Data : 1

有关详细信息，请参见ServicePointManager的实现。

当我的客户将TLS从1.0升级到1.2时，我遇到了这个问题。 我的应用程序使用。net framework 3.5和运行在服务器上。所以我用这种方法来解决它:

修复程序

在调用HttpWebRequest.GetResponse()之前添加以下命令:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 | SecurityProtocolType.Tls | SecurityProtocolTypeExtensions.Tls11 | SecurityProtocolTypeExtensions.Tls12;

通过添加2个新类扩展2个dll: System。网络和系统。安全性。身份验证

    namespace System.Net
    {
        using System.Security.Authentication;
        public static class SecurityProtocolTypeExtensions
        {
            public const SecurityProtocolType Tls12 = (SecurityProtocolType)SslProtocolsExtensions.Tls12;
            public const SecurityProtocolType Tls11 = (SecurityProtocolType)SslProtocolsExtensions.Tls11;
            public const SecurityProtocolType SystemDefault = (SecurityProtocolType)0;
        }
    } 

    namespace System.Security.Authentication
    {
        public static class SslProtocolsExtensions
        {
            public const SslProtocols Tls12 = (SslProtocols)0x00000C00;
            public const SslProtocols Tls11 = (SslProtocols)0x00000300;
        }
    } 

更新Microsoft批处理

批量下载:

windows 2008 R2操作系统:windows6.1-kb3154518-x64.msu windows 2012 R2: windows8.1-kb3154520-x64.msu

下载批量和更多细节，你可以在这里看到:

https://support.microsoft.com/en-us/help/3154518/support-for-tls-system-default-versions-included-in-the-.net-framework-3.5.1-on-windows-7-sp1-and-server-2008-r2-sp1