Default SecurityProtocol in .NET 4.5

by

Some of the those leaving comments on other answers have noted that setting System.Net.ServicePointManager.SecurityProtocol to specific values means that your app won’t be able to take advantage of future TLS versions that may become the default values in future updates to .NET. Instead of specifying a fixed list of protocols, do the following:

For .NET 4.7 or later, do not set System.Net.ServicePointManager.SecurityProtocol. The default value (SecurityProtocolType.SystemDefault) will allow the operating system to use whatever versions it knows and has been configured for, including any new versions that may not have existed at the time the app was created.

For earlier versions of .NET Framework, you can instead turn on or off protocols you know and care about, leaving any others as they are.

To turn on TLS 1.1 and 1.2 without affecting other protocols:

System.Net.ServicePointManager.SecurityProtocol |= 
    SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;

Notice the use of |= to turn on these flags without turning others off.

To turn off SSL3 without affecting other protocols:

System.Net.ServicePointManager.SecurityProtocol &= ~SecurityProtocolType.Ssl3;

More Related Contents:

  1. How does SQLParameter prevent SQL Injection?
  2. .NET obfuscation tools/strategy [closed]
  3. When would I need a SecureString in .NET?
  4. Override Authorize Attribute in ASP.NET MVC
  5. Disable SSL fallback and use only TLS for outbound connections in .NET? (Poodle mitigation)
  6. Are there .NET implementation of TLS 1.2?
  7. how to get private key from PEM file?
  8. Inheritance security rules violated while overriding member – SecurityRuleSet.Level2
  9. How to build RUNAS /NETONLY functionality into a (C#/.NET/WinForms) program?
  10. .Net Framework 4.6.1 not defaulting to TLS 1.2
  11. Secure Password Hashing [closed]
  12. How can I avoid SQL injection attacks in my ASP.NET application?
  13. User Group and Role Management in .NET with Active Directory
  14. Encrypting appSettings in web.config
  15. WCF error: The caller was not authenticated by the service
  16. Accept self-signed TLS/SSL certificate in VB.NET
  17. Can strong naming an assembly be used to verify the assembly author?
  18. Is “Code Access Security” of any real world use?
  19. How to securely store a connection string in a WinForms application?
  20. Memory randomization as application security enhancement?
  21. What is a dependency property?
  22. Managed ODP.NET driver does not show up in Data Source dialog
  23. Generate C# classes from JSON Schema [closed]
  24. Encrypting connectionStrings section – utility for app.config
  25. msbuild, defining Conditional Compilation Symbols
  26. System.BadImageFormatException An attempt was made to load a program with an incorrect format
  27. Dapper and SQL Injections
  28. Are nested Try/Catch blocks a bad idea?
  29. Determine whether .NET assemblies were built from the same source
  30. String.Split VS. Regex.Split?

Leave a Comment