11

As per PCI, we need to stop using SSL and TLS(1.0 and 1.1 in certain implementation) from June 30th 2016 as per http://blog.securitymetrics.com/2015/04/pci-3-1-ssl-and-tls.html

We have an client application build on .Net 3.5 which uses HttpWebRequest object to connect to web services.

As per MSDN SecurityProtocolType(https://msdn.microsoft.com/en-us/library/system.net.securityprotocoltype(v=vs.110).aspx) supports only Ssl3 and Tls(1.0) on .Net Framework 4 or below. Tls11 and Tls12 are only supported in .Net Framework 4.5/4.6

Does that mean to be inside Cardholder data environment and fully pci compliant, we need to upgrade all applications to .Net 4.5/4.6 and allow only Tls12 SecurityProtocolType to connect to external web services using HttpWebRequest?

Nirlep
  • 566
  • 1
  • 5
  • 13

4 Answers4

4

Actually, you can use TLS 1.2 in Frameworks lower than 4.5 (at least I managed it in .NET Framework 4 client). Instead of using the classic command in order to set the Protocol as Tls12, you can bypass it by using the id for this protocol. 

  ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;
tzes
  • 156
  • 2
  • 11
  • This only works if the server has Framework 4.5 installed. – Brian May 12 '17 at 20:14
  • 1
    @Brian I had no problem running it on .NET Framework 4 client – tzes May 12 '17 at 21:01
  • It's possible that some of the hot-fixes included with Windows Update added support even without Framework 4.5 installed. Or Windows Update installed Framework 4.5 without you noticing. – Brian May 15 '17 at 12:54
  • this is the only change I have made, set `SecurityProtocol = TLS11` then can connect and get response from the WebServices (Test enviroment). is this enough? – Logar314159 Sep 07 '17 at 18:49
2

Any communication channel that currently uses SSL/early TLS or that is willing to accept them on negotiation and that is part of the cardholder data environment as a security control needs to be changed such that it will only use TLS 1.1 (with an approved cipher suite) or above.

You need to recompile under .Net 4.5 or greater (TLS 1.2 is not enabled by default so code changes are needed) or use a 3rd party library that supports the required protocols.

Note that if you know your system is using SSL/early TLS you must created a risk mitigation plan/document.

INFORMATION SUPPLEMENT Migrating from SSL and Early TLS

Alex K.
  • 159,548
  • 29
  • 245
  • 267
  • Is there any possibility for Microsoft to release a patch for .Net 2.0 and above to support TLS 1.2 for security? The reason is that most companies will not have resources planned to recompile all applications within cardholder data environment to .Net 4.5 by June 30th 2016. – Nirlep Jul 09 '15 at 17:31
  • 1
    Personally I hugely doubt it, their solution was to implement TLS 1.1+ in .Net 4.5. – Alex K. Jul 09 '15 at 17:51
  • 1
    Recompiling with .Net 4.6 as a target does not require code changes, as .Net 4.6 enables TLS 1.2 by default. A recompile can be avoided entirely for most applications targeting .Net 3.5 or higher by modifying the registry (see instructions on https://technet.microsoft.com/en-us/library/security/2960358.aspx#ID0ETHAE ). This changes default behavior. Applications which specify security protocol explicitly will still require a code change. – Brian May 12 '17 at 20:14
1

Microsoft have done the unthinkable and published patches for this

  • KB3154518 - Reliability Rollup HR-1605 - NDP 2.0 SP2 - Win7 SP1/Win 2008 R2 SP1
  • KB3154519 - Reliability Rollup HR-1605 - NDP 2.0 SP2 - Win8 RTM/Win 2012 RTM
  • KB3154520 - Reliability Rollup HR-1605 - NDP 2.0 SP2 - Win8.1RTM/Win 2012 R2 RTM
  • KB3156421 - 1605 HotFix Rollup through Windows Update for Windows 10.
Chris Gill
  • 2,718
  • 5
  • 23
  • 30
0

The one thing they don't seem to have done, is update wsdl.exe to support TLS1.1 or 1.2. This is what happens if you try and point wsdle.exe form .Net 4.7 at a web service that doesn't support TLS1.0:

Microsoft (R) Web Services Description Language Utility
[Microsoft (R) .NET Framework, Version 4.7.2558.0]
Copyright (C) Microsoft Corporation. All rights reserved.
Error: There was an error processing 'http://<some.domain>/_vti_bin/Authentication.asmx?wsdl'.
  - There was an error downloading 'http://<some.domain>/_vti_bin/Authentication.asmx?wsdl'.
  - The underlying connection was closed: An unexpected error occurred on a send.
  - Authentication failed because the remote party has closed the transport stream.

This is causing me some real issues, and just stunned that this app has still not been updated!

cyberspy
  • 894
  • 10
  • 13