Login/Register
SSL and Outdated TLS(1.0 and 1.1) for Web Service client application on .Net 3.5
Asked Answered
Solved c#.netsslpci-compliancetls1.2
U

4

11

As per PCI, we need to stop using SSL and TLS(1.0 and 1.1 in certain implementation) from June 30th 2016 as per http://blog.securitymetrics.com/2015/04/pci-3-1-ssl-and-tls.html

We have an client application build on .Net 3.5 which uses HttpWebRequest object to connect to web services.

As per MSDN SecurityProtocolType(https://msdn.microsoft.com/en-us/library/system.net.securityprotocoltype(v=vs.110).aspx) supports only Ssl3 and Tls(1.0) on .Net Framework 4 or below. Tls11 and Tls12 are only supported in .Net Framework 4.5/4.6

Does that mean to be inside Cardholder data environment and fully pci compliant, we need to upgrade all applications to .Net 4.5/4.6 and allow only Tls12 SecurityProtocolType to connect to external web services using HttpWebRequest?

Unmuzzle answered 9/7, 2015 at 12:19 Comment(0)
B
2

Any communication channel that currently uses SSL/early TLS or that is willing to accept them on negotiation and that is part of the cardholder data environment as a security control needs to be changed such that it will only use TLS 1.1 (with an approved cipher suite) or above.

You need to recompile under .Net 4.5 or greater (TLS 1.2 is not enabled by default so code changes are needed) or use a 3rd party library that supports the required protocols.

Note that if you know your system is using SSL/early TLS you must created a risk mitigation plan/document.

INFORMATION SUPPLEMENT Migrating from SSL and Early TLS

Bughouse answered 9/7, 2015 at 16:14 Comment(3)
Is there any possibility for Microsoft to release a patch for .Net 2.0 and above to support TLS 1.2 for security? The reason is that most companies will not have resources planned to recompile all applications within cardholder data environment to .Net 4.5 by June 30th 2016. – Unmuzzle
Personally I hugely doubt it, their solution was to implement TLS 1.1+ in .Net 4.5. – Bughouse
Recompiling with .Net 4.6 as a target does not require code changes, as .Net 4.6 enables TLS 1.2 by default. A recompile can be avoided entirely for most applications targeting .Net 3.5 or higher by modifying the registry (see instructions on technet.microsoft.com/en-us/library/security/… ). This changes default behavior. Applications which specify security protocol explicitly will still require a code change. – Smew
C
4

Actually, you can use TLS 1.2 in Frameworks lower than 4.5 (at least I managed it in .NET Framework 4 client). Instead of using the classic command in order to set the Protocol as Tls12, you can bypass it by using the id for this protocol. 

  ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;
Chopfallen answered 25/1, 2017 at 16:30 Comment(4)
This only works if the server has Framework 4.5 installed. – Smew
@Smew I had no problem running it on .NET Framework 4 client – Chopfallen
It's possible that some of the hot-fixes included with Windows Update added support even without Framework 4.5 installed. Or Windows Update installed Framework 4.5 without you noticing. – Smew
this is the only change I have made, set SecurityProtocol = TLS11 then can connect and get response from the WebServices (Test enviroment). is this enough? – Sedimentology
B
2

Any communication channel that currently uses SSL/early TLS or that is willing to accept them on negotiation and that is part of the cardholder data environment as a security control needs to be changed such that it will only use TLS 1.1 (with an approved cipher suite) or above.

You need to recompile under .Net 4.5 or greater (TLS 1.2 is not enabled by default so code changes are needed) or use a 3rd party library that supports the required protocols.

Note that if you know your system is using SSL/early TLS you must created a risk mitigation plan/document.

INFORMATION SUPPLEMENT Migrating from SSL and Early TLS

Bughouse answered 9/7, 2015 at 16:14 Comment(3)
Is there any possibility for Microsoft to release a patch for .Net 2.0 and above to support TLS 1.2 for security? The reason is that most companies will not have resources planned to recompile all applications within cardholder data environment to .Net 4.5 by June 30th 2016. – Unmuzzle
Personally I hugely doubt it, their solution was to implement TLS 1.1+ in .Net 4.5. – Bughouse
Recompiling with .Net 4.6 as a target does not require code changes, as .Net 4.6 enables TLS 1.2 by default. A recompile can be avoided entirely for most applications targeting .Net 3.5 or higher by modifying the registry (see instructions on technet.microsoft.com/en-us/library/security/… ). This changes default behavior. Applications which specify security protocol explicitly will still require a code change. – Smew
E
1

Microsoft have done the unthinkable and published patches for this

  • KB3154518 - Reliability Rollup HR-1605 - NDP 2.0 SP2 - Win7 SP1/Win 2008 R2 SP1
  • KB3154519 - Reliability Rollup HR-1605 - NDP 2.0 SP2 - Win8 RTM/Win 2012 RTM
  • KB3154520 - Reliability Rollup HR-1605 - NDP 2.0 SP2 - Win8.1RTM/Win 2012 R2 RTM
  • KB3156421 - 1605 HotFix Rollup through Windows Update for Windows 10.
Eskimo answered 30/11, 2016 at 13:19 Comment(0)
Z
0

The one thing they don't seem to have done, is update wsdl.exe to support TLS1.1 or 1.2. This is what happens if you try and point wsdle.exe form .Net 4.7 at a web service that doesn't support TLS1.0:

Microsoft (R) Web Services Description Language Utility
[Microsoft (R) .NET Framework, Version 4.7.2558.0]
Copyright (C) Microsoft Corporation. All rights reserved.
Error: There was an error processing 'http://<some.domain>/_vti_bin/Authentication.asmx?wsdl'.
  - There was an error downloading 'http://<some.domain>/_vti_bin/Authentication.asmx?wsdl'.
  - The underlying connection was closed: An unexpected error occurred on a send.
  - Authentication failed because the remote party has closed the transport stream.

This is causing me some real issues, and just stunned that this app has still not been updated!

Zeena answered 7/3, 2018 at 9:58 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.