Request was aborted: Failed to create SSL / TLS secure channel

Question

My client informed me of problems with their SSL and Internet Explorer. They said they were receiving trust issues when accessing the URL.

I am accessing JSON via HTTPS. The website is on the same server and I am using the console application on my local machine. I am trying to bypass the SSL certificate, however my code is still not working.

Can I change the HttpWebRequest to fix this problem?

I get this error using this code:

// You must change the URL to point to your Web server. HttpWebRequest req = (HttpWebRequest)WebRequest.Create(url); req.Method = "GET"; req.AllowAutoRedirect = true; // allows for validation of SSL conversations ServicePointManager.ServerCertificateValidationCallback = delegate { return true; }; WebResponse respon = req.GetResponse(); Stream res = respon.GetResponseStream(); string ret = ""; byte[] buffer = new byte[1048]; int read = 0; while ((read = res.Read(buffer, 0, buffer.Length)) > 0) { //Console.Write(Encoding.ASCII.GetString(buffer, 0, read)); ret += Encoding.ASCII.GetString(buffer, 0, read); } return ret; 

Answer 1

I turned on logging using this code:

http://blogs.msdn.com/b/dgorti/archive/2005/09/18/471003.aspx

The log was in the bin / debug folder (I was in Debug mode for my console application). You need to add a security protocol type as SSL 3

I got an algorithm mismatch in the log. Here is my new code:

  // You must change the URL to point to your Web server. HttpWebRequest req = (HttpWebRequest)WebRequest.Create(url); req.Method = "GET"; ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3; // Skip validation of SSL/TLS certificate ServicePointManager.ServerCertificateValidationCallback = delegate { return true; }; WebResponse respon = req.GetResponse(); Stream res = respon.GetResponseStream(); string ret = ""; byte[] buffer = new byte[1048]; int read = 0; while ((read = res.Read(buffer, 0, buffer.Length)) > 0) { Console.Write(Encoding.ASCII.GetString(buffer, 0, read)); ret += Encoding.ASCII.GetString(buffer, 0, read); } return ret; 

Answer 2

I had to include other versions of the security protocol to fix the problem:

  ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12 | SecurityProtocolType.Ssl3; 

Answer 3

Like the existing answer , but in PowerShell:

 [System.Net.ServicePointManager]::SecurityProtocol = ` [System.Net.SecurityProtocolType]::Tls11 -bor [System.Net.SecurityProtocolType]::Tls12 -bor ` [System.Net.SecurityProtocolType]::Tls -bor ` [System.Net.SecurityProtocolType]::Ssl3 

Then the Invoke-WebRequest call should work.

Got this from anonymous feedback, good suggestion: The easiest way to write this is:

 [System.Net.ServicePointManager]::SecurityProtocol = @("Tls12","Tls11","Tls","Ssl3") 

Found this fantastic and kindred post from Jaykul: Checking self-signed certificates from .Net and PowerShell

Answer 4

This can be caused by several things (most likely, the least likely):

• The SSL server certificate is not trusted by the client. The easiest check is to point the browser to the URL and see if there is an SSL badge icon. If you get a broken lock, icon, click on it to find out what the problem is:

  • Expired Dates - Get a New SSL Certificate
  • The name does not match - make sure your URL uses the same server name as the certificate.
  • Not signed by a trusted authority - buy a certificate from a authority such as Verisign, or add the certificate to the client’s trusted certificate store.
  • In test environments, you can upgrade the certificate verification tool to skip access checks. Do not do this in production.

• The server requires an SSL client certificate - in this case you will have to update your code to sign a request with a client certificate.

Answer 5

See the link below once. SecurityProtocolType.SsL3 is now old.

http://codemust.com/poodle-vulnerability-fix-openssl/

Answer 6

I found that the type of certificate is also included in the game.

I had a certificate that was:

(the result below was in mmc, certificate properties)

Digital Signature, Key Encryption (a0)

(the result below was from my C # code below)

X509Extension.X509KeyUsageExtension.KeyUsages = 'KeyEncipherment, DigitalSignature' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.CrlSign = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DataEncipherment = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DecipherOnly = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags. DigitalSignature = 'True' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.EncipherOnly = ' False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyAgreement = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyCertSign = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyEncipherment = 'True' X509KeyUsageExtension .KeyUsages.X509KeyUsageFlags.None = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.NonRepudiation = 'False'

above did not work .

=================================

Then another certificate with:

(the result below was in mmc, certificate properties)

Signing Certificates, Signing CRL Offline, Signing CRL (06)

(the result below was from my C # code below)

X509Extension.X509KeyUsageExtension.KeyUsages = 'CrlSign, KeyCertSign' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.CrlSign = 'True' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DataEncipherment = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DecipherOnly = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags. DigitalSignature = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.EncipherOnly = ' False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyAgreement = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyCertSign = 'True' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyEncipherment = 'False' X509KeyUsageExtension .KeyUsages.X509KeyUsageFlags.None = 'False' X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.NonRepudiation = 'False'

and he worked

In the code below you can verify your client certificate

 using System; using System.Collections.Generic; using System.Linq; using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates; using System.Text; namespace MyNamespace { public static class SecurityShower { public static void ShowHttpWebRequest(System.Net.HttpWebRequest hwr) { StringBuilder sb = new StringBuilder(); if (null != hwr) { sb.Append("-----------------------------------------------HttpWebRequest" + System.Environment.NewLine); sb.Append(string.Format("HttpWebRequest.Address.AbsolutePath='{0}'", hwr.Address.AbsolutePath) + System.Environment.NewLine); sb.Append(string.Format("HttpWebRequest.Address.AbsoluteUri='{0}'", hwr.Address.AbsoluteUri) + System.Environment.NewLine); sb.Append(string.Format("HttpWebRequest.Address='{0}'", hwr.Address) + System.Environment.NewLine); sb.Append(string.Format("HttpWebRequest.RequestUri.AbsolutePath='{0}'", hwr.RequestUri.AbsolutePath) + System.Environment.NewLine); sb.Append(string.Format("HttpWebRequest.RequestUri.AbsoluteUri='{0}'", hwr.RequestUri.AbsoluteUri) + System.Environment.NewLine); sb.Append(string.Format("HttpWebRequest.RequestUri='{0}'", hwr.RequestUri) + System.Environment.NewLine); foreach (X509Certificate cert in hwr.ClientCertificates) { sb.Append("START*************************************************"); ShowX509Certificate(sb, cert); sb.Append("END*************************************************"); } } string result = sb.ToString(); Console.WriteLine(result); } public static void ShowCertAndChain(X509Certificate2 cert) { X509Chain chain = new X509Chain(); chain.ChainPolicy.RevocationFlag = X509RevocationFlag.EntireChain; chain.ChainPolicy.RevocationMode = X509RevocationMode.Offline; chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllFlags; ////chain.ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreCtlSignerRevocationUnknown && ////X509VerificationFlags.IgnoreRootRevocationUnknown && ////X509VerificationFlags.IgnoreEndRevocationUnknown && ////X509VerificationFlags.IgnoreCertificateAuthorityRevocationUnknown && ////X509VerificationFlags.IgnoreCtlNotTimeValid; chain.Build(cert); ShowCertAndChain(cert, chain); } public static void ShowCertAndChain(X509Certificate cert, X509Chain chain) { StringBuilder sb = new StringBuilder(); if (null != cert) { ShowX509Certificate(sb, cert); } if (null != chain) { sb.Append("-X509Chain(Start)-" + System.Environment.NewLine); ////sb.Append(string.Format("Cert.ChainStatus='{0}'", string.Join(",", chain.ChainStatus.ToList())) + System.Environment.NewLine); foreach (X509ChainStatus cstat in chain.ChainStatus) { sb.Append(string.Format("X509ChainStatus::'{0}'-'{1}'", cstat.Status.ToString(), cstat.StatusInformation) + System.Environment.NewLine); } X509ChainElementCollection ces = chain.ChainElements; ShowX509ChainElementCollection(sb, ces); sb.Append("-X509Chain(End)-" + System.Environment.NewLine); } string result = sb.ToString(); Console.WriteLine(result); } private static void ShowX509Extension(StringBuilder sb, int x509ExtensionCount, X509Extension ext) { sb.Append(string.Empty + System.Environment.NewLine); sb.Append(string.Format("--------X509ExtensionNumber(Start):{0}", x509ExtensionCount) + System.Environment.NewLine); sb.Append(string.Format("X509Extension.Critical='{0}'", ext.Critical) + System.Environment.NewLine); AsnEncodedData asndata = new AsnEncodedData(ext.Oid, ext.RawData); sb.Append(string.Format("Extension type: {0}", ext.Oid.FriendlyName) + System.Environment.NewLine); sb.Append(string.Format("Oid value: {0}", asndata.Oid.Value) + System.Environment.NewLine); sb.Append(string.Format("Raw data length: {0} {1}", asndata.RawData.Length, Environment.NewLine) + System.Environment.NewLine); sb.Append(asndata.Format(true) + System.Environment.NewLine); X509BasicConstraintsExtension basicEx = ext as X509BasicConstraintsExtension; if (null != basicEx) { sb.Append("-X509BasicConstraintsExtension-" + System.Environment.NewLine); sb.Append(string.Format("X509Extension.X509BasicConstraintsExtension.CertificateAuthority='{0}'", basicEx.CertificateAuthority) + System.Environment.NewLine); } X509EnhancedKeyUsageExtension keyEx = ext as X509EnhancedKeyUsageExtension; if (null != keyEx) { sb.Append("-X509EnhancedKeyUsageExtension-" + System.Environment.NewLine); sb.Append(string.Format("X509Extension.X509EnhancedKeyUsageExtension.EnhancedKeyUsages='{0}'", keyEx.EnhancedKeyUsages) + System.Environment.NewLine); foreach (Oid oi in keyEx.EnhancedKeyUsages) { sb.Append(string.Format("------------EnhancedKeyUsages.Oid.FriendlyName='{0}'", oi.FriendlyName) + System.Environment.NewLine); sb.Append(string.Format("------------EnhancedKeyUsages.Oid.Value='{0}'", oi.Value) + System.Environment.NewLine); } } X509KeyUsageExtension usageEx = ext as X509KeyUsageExtension; if (null != usageEx) { sb.Append("-X509KeyUsageExtension-" + System.Environment.NewLine); sb.Append(string.Format("X509Extension.X509KeyUsageExtension.KeyUsages='{0}'", usageEx.KeyUsages) + System.Environment.NewLine); sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.CrlSign='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.CrlSign) != 0) + System.Environment.NewLine); sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DataEncipherment='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.DataEncipherment) != 0) + System.Environment.NewLine); sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DecipherOnly='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.DecipherOnly) != 0) + System.Environment.NewLine); sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.DigitalSignature='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.DigitalSignature) != 0) + System.Environment.NewLine); sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.EncipherOnly='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.EncipherOnly) != 0) + System.Environment.NewLine); sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyAgreement='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.KeyAgreement) != 0) + System.Environment.NewLine); sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyCertSign='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.KeyCertSign) != 0) + System.Environment.NewLine); sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.KeyEncipherment='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.KeyEncipherment) != 0) + System.Environment.NewLine); sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.None='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.None) != 0) + System.Environment.NewLine); sb.Append(string.Format("X509KeyUsageExtension.KeyUsages.X509KeyUsageFlags.NonRepudiation='{0}'", (usageEx.KeyUsages & X509KeyUsageFlags.NonRepudiation) != 0) + System.Environment.NewLine); } X509SubjectKeyIdentifierExtension skIdEx = ext as X509SubjectKeyIdentifierExtension; if (null != skIdEx) { sb.Append("-X509SubjectKeyIdentifierExtension-" + System.Environment.NewLine); sb.Append(string.Format("X509Extension.X509SubjectKeyIdentifierExtension.Oid='{0}'", skIdEx.Oid) + System.Environment.NewLine); sb.Append(string.Format("X509Extension.X509SubjectKeyIdentifierExtension.SubjectKeyIdentifier='{0}'", skIdEx.SubjectKeyIdentifier) + System.Environment.NewLine); } sb.Append(string.Format("--------X509ExtensionNumber(End):{0}", x509ExtensionCount) + System.Environment.NewLine); } private static void ShowX509Extensions(StringBuilder sb, string cert2SubjectName, X509ExtensionCollection extColl) { int x509ExtensionCount = 0; sb.Append(string.Format("--------ShowX509Extensions(Start):for:{0}", cert2SubjectName) + System.Environment.NewLine); foreach (X509Extension ext in extColl) { ShowX509Extension(sb, ++x509ExtensionCount, ext); } sb.Append(string.Format("--------ShowX509Extensions(End):for:{0}", cert2SubjectName) + System.Environment.NewLine); } private static void ShowX509Certificate2(StringBuilder sb, X509Certificate2 cert2) { if (null != cert2) { sb.Append(string.Format("X509Certificate2.SubjectName.Name='{0}'", cert2.SubjectName.Name) + System.Environment.NewLine); sb.Append(string.Format("X509Certificate2.Subject='{0}'", cert2.Subject) + System.Environment.NewLine); sb.Append(string.Format("X509Certificate2.Thumbprint='{0}'", cert2.Thumbprint) + System.Environment.NewLine); sb.Append(string.Format("X509Certificate2.HasPrivateKey='{0}'", cert2.HasPrivateKey) + System.Environment.NewLine); sb.Append(string.Format("X509Certificate2.Version='{0}'", cert2.Version) + System.Environment.NewLine); sb.Append(string.Format("X509Certificate2.NotBefore='{0}'", cert2.NotBefore) + System.Environment.NewLine); sb.Append(string.Format("X509Certificate2.NotAfter='{0}'", cert2.NotAfter) + System.Environment.NewLine); sb.Append(string.Format("X509Certificate2.PublicKey.Key.KeySize='{0}'", cert2.PublicKey.Key.KeySize) + System.Environment.NewLine); ////List<X509KeyUsageExtension> keyUsageExtensions = cert2.Extensions.OfType<X509KeyUsageExtension>().ToList(); ////List<X509Extension> extensions = cert2.Extensions.OfType<X509Extension>().ToList(); ShowX509Extensions(sb, cert2.Subject, cert2.Extensions); } } private static void ShowX509ChainElementCollection(StringBuilder sb, X509ChainElementCollection ces) { int x509ChainElementCount = 0; foreach (X509ChainElement ce in ces) { sb.Append(string.Empty + System.Environment.NewLine); sb.Append(string.Format("----X509ChainElementNumber:{0}", ++x509ChainElementCount) + System.Environment.NewLine); sb.Append(string.Format("X509ChainElement.Cert.SubjectName.Name='{0}'", ce.Certificate.SubjectName.Name) + System.Environment.NewLine); sb.Append(string.Format("X509ChainElement.Cert.Issuer='{0}'", ce.Certificate.Issuer) + System.Environment.NewLine); sb.Append(string.Format("X509ChainElement.Cert.Thumbprint='{0}'", ce.Certificate.Thumbprint) + System.Environment.NewLine); sb.Append(string.Format("X509ChainElement.Cert.HasPrivateKey='{0}'", ce.Certificate.HasPrivateKey) + System.Environment.NewLine); X509Certificate2 cert2 = ce.Certificate as X509Certificate2; ShowX509Certificate2(sb, cert2); ShowX509Extensions(sb, cert2.Subject, ce.Certificate.Extensions); } } private static void ShowX509Certificate(StringBuilder sb, X509Certificate cert) { sb.Append("-----------------------------------------------" + System.Environment.NewLine); sb.Append(string.Format("Cert.Subject='{0}'", cert.Subject) + System.Environment.NewLine); sb.Append(string.Format("Cert.Issuer='{0}'", cert.Issuer) + System.Environment.NewLine); sb.Append(string.Format("Cert.GetPublicKey().Length='{0}'", cert.GetPublicKey().Length) + System.Environment.NewLine); X509Certificate2 cert2 = cert as X509Certificate2; ShowX509Certificate2(sb, cert2); } } }