Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

I would like to know how the property ServicePointManager.SecurityProtocol works when I set three different SecurityProtocolType on her flags. I.E:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls12 | SecurityProtocolType.Ssl3;
Will the communication try first to communicate with TLS, and if it fails try  TLS1.2 and after SSL3? 
If not, what do these flags mean and how does it work? 
Whichever communication object you're using (HttpClient, HttpWebRequest, etc) will try to negotiate to the highest level possible first. Failing that it will keep going "down" the chain.
If you're using .Net 4.6 then the default security protocols will look like this because SSL3 is broken:
SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12
If you really need to use SSL3 for some reason and are using .Net 4.6, see this MS KB article on how to force it to be insecure: https://support.microsoft.com/en-us/kb/3069494
You might also be asking how this protocol level is actually determined? This is step 1 of the SSL handshake process where each end of the connection says "I support this version". Here is an interesting read on the full handshake process: http://www.truedigitalsecurity.com/blog/2015/05/20/ssltls-protocol-version-negotiation/
                I have one more doubt, if the client-side accepts only TLS 1.0 and TLS 1.1 but the server accepts only TLS 1.2, the communication will be realized with success? Have tls 1.2 in server compatibility with tls 1.1 in client ?
– Only a Curious Mind
                Jun 20, 2016 at 16:33
                If the server only supports 1.2 and nothing else, you had better have 1.2 in your ServicePointManager or it won't work. This sort of thing happened when SSLv3 was deprecated and some servers only supported SSLv3 still, yet .Net 4.6 doesn't by default so communication broke down. Having 1.0/1.1/1.2 is a safe bet for now. Revisit this once 1.0 gets broken.
– Bill Sambrone
                Jun 20, 2016 at 17:12
                Try this update link for the truedigitalsecurity blog post: truedigitalsecurity.com/blog/…
– Sonny N
                Jun 10, 2021 at 18:39
        
Thanks for contributing an answer to Stack Overflow!
Please be sure to answer the question. Provide details and share your research!
But avoid …
Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.