I use WCF with TLS encryption and disable TLS in registry, but I can still communicate normally. Why?

Aspire 81

I have an application which uses WCF with TLS encryption.
Client side:
NetTcpBinding Bindings = new NetTcpBinding;
Bindings.MaxReceiveMessageSize = 2147483647;
Bindings.Security.Transport.SslProtocols = SslProtocols.Tls12;
Bindings.Security.Mode = SecurityMode.Transport;

Server side is the same.
I use two Windows 10 21H2 to work as client and server.
Firstly, I enabled TLS 1.2 through the registry and Client and Server work fine.
Secondly, I disabled TLS 1.2 on both machine and restart.
When I test, I found that Client and Server can still work.
My question is why TLS 1.2 has been disabled and only TLS 1.2 encryption is set in the code, but actually the program can still be encrypted successfully.

Lex Li (Microsoft) 4,742 Reputation points Microsoft Employee

2022-11-18T04:44:10.903+00:00

You have to reveal the exact steps of how you "disabled TLS 1.2".
Aspire 81 Reputation points

2022-11-18T05:05:31.813+00:00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000

I ran the above script
Aspire 81 Reputation points

2022-11-18T06:10:11.487+00:00

In addition, when client and server in the same machine, if I disable TLS 1.1 or TLS 1.2, the client and server can still communicate normally. It's strange.
Jiayao Wu-MSFT 186 Reputation points Microsoft Vendor

2022-11-18T07:33:50.18+00:00

Hi @Aspire ,

After changing the files in the SCHANNEL path, you need to restart the computer. Have you done this step.

Regards,
Jiayao Wu
Aspire 81 Reputation points

2022-11-18T08:15:45.567+00:00

yes , I restart and still work.
Lex Li (Microsoft) 4,742 Reputation points Microsoft Employee

2022-11-19T17:53:48.783+00:00

Are you able to use a tool like Wireshark to analyze the handshake? Can you confirm the client/server connect via TLS 1.2 across the two machines?
Aspire 81 Reputation points

2022-11-20T10:13:00.887+00:00

Seen from Wireshark, the data has been encrypted, but the protocol type displayed in Wireshark is TCP, so I'm not sure whether client/server connect via TLS 1.2.
Lex Li (Microsoft) 4,742 Reputation points Microsoft Employee

2022-11-20T20:46:49.957+00:00

TLS connections are upon TCP, so no surprise. You might refer to https://wiki.wireshark.org/TLS to learn more about how to understand the captured packets. There are tons of others from search engines.
Jiayao Wu-MSFT 186 Reputation points Microsoft Vendor

2022-11-21T02:57:52.303+00:00

Hi @Aspire ,

In general, do not specify the version of TLS. Let the operating system determine it.

1 answer

AgaveJoe 26,201 Reputation points

2022-11-18T18:09:24.947+00:00

According to the docs...

If you want to configure security with the registry, don't specify a security protocol value in your code; doing so overrides the registry setting.

Transport Layer Security (TLS) best practices with the .NET Framework

Usually when testing TLS you disable SSL and TLS 1.0 and 1.1 on the servers. Then make sure the code still works.
Please sign in to rate this answer.
Aspire 81 Reputation points

2022-11-19T14:28:55.703+00:00

Thank you for your answer. Do you mean that the TLS version should not be specified in the code? If I only want the code to be encrypted using TLS1.2 protocol, how can I implement it in the code?

AgaveJoe 26,201 Reputation points

2022-11-19T17:49:21.267+00:00

The information you seek is in the link and why I posted it.
Sign in to comment