TLS 1.3 support using SChannel in Windows 11 without Curl lib

Ajaykumar Jaiswal 6

Hello,

I'm working on a TLS client application that needs to be upgraded to use TLS 1.3 in Windows-11.
Has anyone successfully implemented TLS 1.3 using SChannel APIs?

As per Microsoft below link TLS 1.3 is supported in win-11 & server-2022
https://learn.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-

We used the SCH_CREDENTIALS structure instead of the SCHANNEL_CRED structure with AcquireCredentialsHandle() and it passed, and with this change we are not getting any error but when connection is about to established, connect gets dropped. We tried doing multiple change we could not find the appropriate fix.

Could anyone please help us to understand whether Windows-11 (all build version) support TLS 1.3 using SChannel or not.

We are testing in below build version of windows.
Windows version tested with: windows 11 21h2 os build 22000.675

Tried the below change to fix the same:
Registry Change: as suggested below link: https://stackoverflow.com/questions/56072561/how-to-enable-tls-1-3-in-windows-10

Any suggestion or a small sample of C++ code snipped is well appreciated, as well as any advice which may help me to understand what is wrong with the client.

Thank you
Regards: Ajay

Junjie Zhu - MSFT 14,136 Reputation points Microsoft Vendor

2022-05-31T03:08:30.893+00:00

Could show how you use AcquireCredentialsHandle, and what object your program connects to?

Ajaykumar Jaiswal 6

Thank you @Junjie Zhu - MSFT
I am sharing the code sample snip below which I am trying to use

 SCH_CREDENTIALS SchannelCred;  
   TimeStamp tsExpiry;  
   TLS_PARAMETERS TlsParameters = { 0 };  
  
   TlsParameters.cAlpnIds = 0;  
   TlsParameters.rgstrAlpnIds = NULL;   
   TlsParameters.cDisabledCrypto = 0;  
   TlsParameters.pDisabledCrypto = NULL;  
   TlsParameters.grbitDisabledProtocols = (DWORD)~SP_PROT_TLS1_3_CLIENT;  
   PSecurityFunctionTable sspi = InitSecurityInterface();  
  
   // fill in SCH_CREDENTIALS structure  
   SecureZeroMemory(&SchannelCred, sizeof(SchannelCred));  
   SchannelCred.dwVersion = SCH_CREDENTIALS_VERSION;  
   SchannelCred.cTlsParameters = 1;  
   SchannelCred.pTlsParameters = &TlsParameters;  
  
   SchannelCred.dwFlags |= SCH_CRED_MANUAL_CRED_VALIDATION | SCH_CRED_NO_DEFAULT_CREDS ;  
  
	  
   
   SECURITY_STATUS status = sspi->AcquireCredentialsHandle(NULL,  
	   (SEC_CHAR*)UNISP_NAME_A, SECPKG_CRED_OUTBOUND, NULL, &SchannelCred, NULL, NULL, phCred,&tsExpiry);

AcquireCredentialsHandle function return status is 0(PASSED)
Please suggest if something is wrong here

Junjie Zhu - MSFT 14,136 Reputation points Microsoft Vendor

2022-06-01T07:51:12.223+00:00

What is your connection object? Is there any error message? Is there a message for GetLastError()?
Ajaykumar Jaiswal 6 Reputation points

2022-06-01T07:59:26.153+00:00

no error,
status and GetLastError() both value is 0(Zero),
but my clint application when it's about to connect , connection gets drop.
Want to know is something wrong with my code or windows-11 not supporting TLS 1.3 with Schannel.

Thank you
Regards: Ajay
Junjie Zhu - MSFT 14,136 Reputation points Microsoft Vendor

2022-06-01T08:29:24.693+00:00

Windows 11 supports TLS1.3

I can also successfully connect to Google using TLS1.3 in win11. It is still unclear where your problem is. If it is convenient, could you provide a code sample that can reproduce your problem and can be run? Does not contain any personal privacy.
Ajaykumar Jaiswal 6 Reputation points

2022-06-01T09:19:46.863+00:00

Are you connecting to Google using TLS 1.3 with Schannel ?
You have your client application or you are using 3rd party tool, Hope it's not browser?

Our case using Schannel, we are unable to connect with TLS 1.3
Junjie Zhu - MSFT 14,136 Reputation points Microsoft Vendor

2022-06-01T09:26:28.203+00:00

I use winsock to connect without using third-party tools such as openssl. Is it convenient to provide test code samples without personal privacy?
Ajaykumar Jaiswal 6 Reputation points

2022-06-02T12:57:29.397+00:00

We will not be able to share the sample.

Thank you
Regards: Ajay
Junjie Zhu - MSFT 14,136 Reputation points Microsoft Vendor

2022-06-03T02:26:05.923+00:00
Then I may not be able to help you find the specific problem, but I think the problem should be in the connection or handshake, you can try to use Winsock api to connect.

https://learn.microsoft.com/en-us/windows/win32/winsock/complete-client-code

https://learn.microsoft.com/en-us/windows/win32/secauthn/initializesecuritycontext--schannel