CODEWITHSUNDEEP
c#https.net-4.6
bartosz.lipinski
bartosz.lipinski

Reputation: 2667

SSL/TLS error with HTTPClient

I am trying to connect to internal website that is using properly signed SSL certificate (works in Chrome 58) but when I execute this code in .Net it throws error:

The Request was aborted: Could not create SSL/TLS channel.

ServicePointManager.MaxServicePointIdleTime = 0;
ServicePointManager.Expect100Continue = true;
ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls
                    | SecurityProtocolType.Tls11
                    | SecurityProtocolType.Tls12
                    | SecurityProtocolType.Ssl3;

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Get, "https://internal-website");
request.Headers.Add("token", "---");
var result = client.SendAsync(request);
result.Wait();

The only reason I can think of is the fact that certificate is using Subject Alternative Name for DNS names (it has 4 entries there) and CN doesn't match any of them but it still works in Chrome and Postman.

The code that I've added before creating HttpClient was to disable SSL check but it didn't work any ideas how I can debug this issue?

Upvotes: 0

Views: 1466

Answers (1)

bartosz.lipinski
bartosz.lipinski

Reputation: 2667

After quite a bit of investigation, it turned out to be a problem with the length of DHE key.

.Net and IE require DHE to be greater or equal to 1024 but for this service, the key was 512. Reference to Microsoft KB

If changing key length on the server is not possible you can change registry on the user machine.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman] "ClientMinKeyBitLength"=dword:00000200

Upvotes: 1

Related Questions