TLS Behavior

This article answers addition hidden TLS behavior mysteries relating to .NET Framework 3.5x & 4.7 compiled Apps, and what to expect.

Registry Settings & Ideal TLS Behavior

When SystemDefaultTlsVersions registry key is enabled (either an AppContext switch*, or by the Windows Registry), the .NET Framework compiled application relies on the platform or OS to negotiate TLS. The highest supported TLS version is always preferred in the TLS handshake.

Available for .NET Framework Versions: 4.8, 4.7.2, 4.7.1, 4.7, 3.5 and 3.5.1

Additional Details:

With .NET 4.7 (and greater) application versions, there is a new built-in default behavior which changes how TLS negotiates. .NET 4.7 applications now rely on SCHANNEL to negotiate TLS protocols (on it’s behalf). This particular behavior varies from earlier versions as they instruct SCHANNEL to negotiate using a predefined set of TLS Protocols.

This default behavior can be turned off by disabling SystemDefaultTlsVersions via the system registry. This will force .NET 4.7 (and greater) applications to utilize internal TLS protocol capabilities (not recommended).

Although .NET 4.7 (and greater) application versions rely on SCHANNEL to negotiate TLS protocols, SchUseStrongCrypto by default partially remains in effect – meaning use of weak cryptography ciphers are disabled. (see 4.7 & above default behavior)

A patch is available for .NET 3.5x allowing SystemDefaultTlsVersions to be enabled via the system registry.

Recommendation – TLS Behavior

Due to the fact that nearly all Microsoft business productivity systems (i.e. workstations and servers) invariably maintains a mixture and number of varying installed .NET application, it is HIGHLY recommended to level-set (via GPOs) SystemDefaultTlsVersions across ALL Windows platforms.

Level-setting SystemDefaultTlsVersions in the registry provides two important benefits:

• Forces .NET 3.5x and .NET 4.7 (and greater) application versions to rely on the Platform or OS (SCHANNEL) to negotiate TLS protocol
• Avoids variances and tampering of TLS behavior

SystemDefaultTlsVersions Flag:

• • Value of 1 causes your app to allow the operating system to choose or negotiate the TLS protocol
  • Value of 0 causes the compiled application to use protocols picked by the .NET Framework

.NET Version TLS Behavior

SystemDefaultTlsVersions is available for the following versions of:

• .NET applications 3.5 – 3.5.1 (disabled by default)
• .NET applications 4.7 – 4.8+ (enabled by default)
• .NET 3.5 and 3.5.1 compiled applications can make use of SystemDefaultTlsVersions registry setting. It is however undefined by default (not enabled)
• .NET Framework compiled application version 4.7 or greater (by default) relies on the Secure Channel (SCHANNEL) to negotiate TLS, and ignores it’s built-in defined TLS protocols settings – AppContext switch can override this setting

*Note: AppContext switch is available for .Net Framework Versions 4.8, 4.7.2, 4.7.1, 4.7, 4.6.2, 4.6.1 and 4.6

Notes: The .NET framework version 3.5 and earlier versions did not provide support for applications to use Transport Layer Security (TLS) System Default Versions as a cryptographic protocol. This update enables the use of TLS v1.2 in the .NET Framework 3.5. (update link)

LATEST VIDEOS