Windows Server 2012 R2 TLS 1.2 Cipher Suites

Question

Hello - I have a .Net application that accesses an external website to retrieve data. The external website removed TLS 1.1 support and only supports the following TLS 1.2 cipher suites: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 The application works fine when being run from Windows Server 2016 or later (including Win10) but is not able to access the external site when being run on Windows Server 2012 R2 or earlier versions. I understand Server 2008 is end of life but Server 2012 R2 should still be supported, I would think. From what I understand, it appears these specific cipher suites are not available for Server 2012 R2. Will they ever be available, or is there some other way to have my application work with the existing available cipher suites? Thank You

Answer 1

I think the OS upgrade is needed. I've tested on newer OS and Windows 10 and everything works. Check out this page for supported versions: https://learn.microsoft.com/en-us/windows/win32/secauthn/cipher-suites-in-schannel

Browsers seem to use their own code, but in my .net app there is not much you can do.

Good luck

Answer 2

I am also facing the same issue by any chance we can resolve this issue without Updating the Server from 2012 R2 to 2016 or any other ?

I am stuck with this issue from last two days but nothing helped yet.

Answer 3

I'm having same issue due to requirements posting to the site: https://www.fcc.gov/media/radio/haat-calculator, if you look at the SSL Labs Cipher Suites for that site, it wants the TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 Or TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 for TLS 1.2.

Since these are not supported is an OS upgrade the only option to get my program to work on Win Server 2012 R2?

Answer 4

I have a question, too...

We recently ran into issues at 2 customer sites where calls from our .NET Core service using HttpClient fails with Handshake error (40) when posting to an https Apache server. We confirmed no "available" cipher suites in the CLient Hello were accepted by the server. The odd thing is that Postman can run from that same server and it DOES have an acceptable cipher. The one in question that we saw accepted by Postman Client Hello is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 and this one ISN'T offered in "our" call (.NET COre 2.8 HttpClient).

We have seen this on both Server 2012 R2 and Server 2016 Standard. I can maybe understand 2012 R2 failing, because it doesn't look like this cipher is available in that OS, but then why does Postman work?

Is there any way to enable this cipher in 2012 R2?

What about 2016? Is it possible that cipher is allowed but just disabled?

This is all a little fuzzy for me still. Also, what tools are you using to see this information above (SSL Cipher Suite Order)?

Thanks in advance,
Jason

Answer 5

Ok, gotcha. Those are not available for Server 2012 R2. They did not show up until Windows 10/Server 2016
https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-10-v1607

--please don't forget to Accept as answer if the reply is helpful--