Develop Reference

Forcing .NET application to use TLS 1.2 or later

I wonder how to force a .NET application targeting .NET Framework 4.8 to use TLS 1.2 or later (including future TLS versions).
The application execute as a Windows service. For >98% of the users, it is correctly using TLS 1.2 but in a couple of cases it tries to use older versions like TLS 1.0 or even SSL 3.0. The users who have had issues with it using older TLS versions has been able to resolve it by making registry changes, but telling users to reconfigure settings in Windows registry is a bit risky.
I have followed Microsofts recommendation to not hardcoded the application to use a specific TLS version and instead just rely on the OS default (https://learn.microsoft.com/en-us/dotnet/framework/network-programming/tls).
So what I wonder is: Is there some way in a .NET application to:
Use the Windows default TLS version if it's TLS 1.2 or later.
If the Windows default TLS version is SSL 3.0, TLS 1.0 or TLS 1.1 then use TLS 1.2 or later (including TLS 1.3)
I know I can hardcode the TLS version using ServicePointManager.SecurityProtocol, but this goes against Microsofts recommendation and if I hardcode it to TLS 1.2 and 1.3, then whenever TLS 1.4 is used and the customers OS is patched to support it, my application will still use TLS 1.3 which I don't want.

What about adding TLS declaration before calling the action
public static void UploadFile()
{
System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12;
}

How to fix to use TLS 1.2

I am using Windows 10, Visual Studio 2017, .Net 4.7.
And using DocuSign SOAP APIs to send an envelope. My code is using .NET 4.7 - checked in web.config and confirmed in project properties > Application tab.
And yet, I keep getting the error from DocuSign that I need to use TLS 1.2 and that I am using TLS 1.
What else can I do to fix this?

You can always force the TLS version yourself with:
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
However, this shouldn't be necessary under .NET Framework 4.7. TLS 1.2 is the default.
See also this blog post from Docusign.

How can I update Security Protocol to TLS 1.2 at run time

Not able to update the security protocol using the below code called in Application_Start of Global.asax, (Probably because the CAS communication is failing well before reaching this line of code)
ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;
I have my .net application developed in 4.0 framework which is expected to use security protocol earlier than TLS 1.2. I have got a CAS authentication failing to redirect to my application due to TLS issue. To resolve this issue I did made a targeted framework change in web.config as below.
<httpRuntime requestValidationMode="2.0" targetFramework="4.6" />
But above solution is leading to different problems. So right now what I'm trying to figure out is to resolve my CAS issue by using Security Protocol update to 1.2. Please help me how can I deal with my situation.

If .NET 4.5 or greater is installed on your system the code you have posted: ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072; should work without changing the .NET framework your application is targeting.
If you cannot upgrade the .NET framework on your system you will need to set the SchUseStrongCrypto and SystemDefaultTlsVersions registry keys to 1.
From: https://learn.microsoft.com/en-us/dotnet/framework/network-programming/tls
For .NET Framework 3.5 - 4.5.2 and not WCF
We recommend you upgrade your app to .NET Framework 4.7 or later versions. If you cannot upgrade, take the following steps. At some point in the future, your application may fail until you upgrade to .NET Framework 4.7 or later versions.
Set the SchUseStrongCrypto and SystemDefaultTlsVersions registry keys to 1. See Configuring security via the Windows Registry. The .NET Framework version 3.5 supports the SchUseStrongCrypto flag only when an explicit TLS value is passed.

What version of TLS does my C# program use?

I develop a C# program in Visual Studio 2013 which communicates with a SOAP webservice. How can I tell which version of TLS my program uses?

I got the answer by directing my program to make requests to https://www.howsmyssl.com/a/check.

TLS 1.2 was added in .NET 4.5. The earliest supported .NET version is 4.5.2, so you won't have any issues if you use a supported version.
.NET 4.6 uses TLS 1.2 by default. Earlier versions need this line to enable it :
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 |
SecurityProtocolType.Tls11;
TLS 1.0 is being phased out and SSL v3 is considered broken so they shouldn't be added.

Another good way to check is to install WireShark (https://www.wireshark.org/download.html)
and to use it while running your application.
within the TLS Packets you will be able to see versions and such:
Example for Wireshark View Of TLS traffic...

Is TLS 1.1 and TLS 1.2 enabled by default for .NET 4.5 and .NET 4.5.1?

On our Windows 2012 Server R2, we need to disabled TLS 1.0.
However we have .NET 4.5 Wcf services running. We found that if we disable TLS 1.0 that the WCF services no longer run, as we get the error 'An existing connection was forcibly closed by the remote host'.
Is TLS 1.1/1.2 enabled by default in .NET 4.5 and .NET 4.5.1 ? If not, which we assume is the case, where in our WCF project do we force the project to use TLS 1.1/1.2 ?

Is TLS 1.1/1.2 enabled by default in .NET 4.5 and .NET 4.5.1?
No. The default protocols enabled for the various framework versions are:
.NET Framework 4.5 and 4.5.1: SSLv3 and TLSv1
.NET Framework 4.5.2: SSLv3, TLSv1, and TLSv1.1
.NET Framework 4.6 and higher: TLSv1, TLSv1.1, and TLS1.2
Sources: [1] [2] [3]
While Microsoft recommends against explicitly specifying protocol versions in favour of using the operating system's defaults:
To ensure .NET Framework applications remain secure, the TLS version should not be hardcoded. .NET Framework applications should use the TLS version the operating system (OS) supports.
... it's still possible to select which protocols your application supports by using the ServicePointManager class, specifically by setting the SecurityProtocol property to the relevant SecurityProtocolTypes.
In your case you would want to use the following:
System.Net.ServicePointManager.SecurityProtocol =
SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;
Note that TLSv1 and TLSv1.1 are effectively deprecated as of 2020; you should avoid building new applications that rely on these protocols, and make every effort to upgrade applications that currently use them.

The answer by Ian Kemp works without an issue, but I just wanted to provide another answer that means you don't have to recompile your code.
Anything above .NET 4.5 can support TLS 1.2 however the default of anything lower than .NET 4.7 is TLS 1.1. So if you need to access something using TLS 1.2 you get an error as it will be trying to use the default.
You can add the following code to your configuration file, to override the default.
<runtime>
<AppContextSwitchOverrides value="Switch.System.Net.DontEnableSystemDefaultTlsVersions=false"/>
</runtime>
Update
For .NET Framework 4.7 and later versions, defaults to the OS choosing the best security protocol and version.
For .NET Framework 4.6 to 4.6.2 the AppContext switches can be placed in the app.config or webconfig, as the system default will be set to a lower TLS or SSL Version.
<runtime>
<AppContextSwitchOverrides value="Switch.System.Net.DontEnableSystemDefaultTlsVersions=false"/>
</runtime>
For .NET Framework 4.5 to 4.5.2 the registry keys SchUseStrongCrypto and SystemDefaultTlsVersions will need to be set.
HKEY_LOCAL_MACHINE\SOFTWARE\[Wow6432Node\]Microsoft\.NETFramework\<VERSION>: SchUseStrongCrypto
The SchUseStrongCrypto registry key has a value of type DWORD. A value of 1 causes your app to use strong cryptography and a value of 0 disables strong cryptography. The strong cryptography uses more secure network protocols (TLS 1.2, TLS 1.1, and TLS 1.0) and blocks protocols that are not secure. For .NET Framework 4.5.2 or earlier versions, the key defaults to 0. In that case, you should explicitly set its value to 1.
HKEY_LOCAL_MACHINE\SOFTWARE\[Wow6432Node\]Microsoft\.NETFramework\<VERSION>: SystemDefaultTlsVersions
The SystemDefaultTlsVersions registry key has a value of type DWORD. A value of 1 causes your app to allow the operating system to choose the protocol. A value of 0 causes your app to use protocols picked by the .NET Framework.
If the application targets .NET Framework 4.6.1 or earlier versions, the key defaults to 0. In that case, you should explicitly set its value to 1.
Example for 32-bit applications that are running on 32-bit OSs and for 64-bit applications that are running on 64-bit OSs, update the following subkey values:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001
For 32-bit applications that are running on 64-bit OSs, update the following subkey values:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001

I was searching for this answer too, since we have an ASP.NET MVC 4.5.x app running in production.
I think there's an updated answer to this in the official Microsoft docs.
See the following for full details:
https://learn.microsoft.com/en-us/dotnet/framework/network-programming/tls
It looks like you only need to update the values in the Registry.
They recommend that you do not make code changes to handle the difference.
Only if you're running .NET Framework 3.5 do you need to explicitly set a flag value.