Problem: I have a console using CSOM that stopped working when the TLS settings were updated firm-wide. The communication is between the console and a SharePoint farm, using CSOM, and now it no longer works. The event log generates the following error message on the client machine: A fatal error occurred while creating an SSL client credential. The internal error state is 10013.
Initial Hypothesis: The outbound HTTPS traffic is the issue as the error is telling me that the mistake was creating the SSL client credential. The console runs on a web server, and the TLS restriction change has caused the issue. This issue is that the console running can't create an SSL client credential. The TLS change was made to the console VM and not the SharePoint farm. Here is the PS script to validate TLS versions written by Vadims Podans.
The post below helped me query the windows web servers to check the TLS settings using PowerShell. I believe the outbound is controlled by the inbound TLS settings.
Resolution: Change the console to use a know TLS version e.g., TLS1.2 as shown below:
Alternatively, specify all the portocols you support from the calling client side application ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls | SecurityProtocolType.Ssl3;
Read this section if you are still having issues.
Factors that Influence Settings:
My CSOM console sits on a VM that hosts IIS, so there are three components to ensure connectivity excluding networking:
1.> SharePoint Server needs to support the TLS version
2.> VM hosting my console's outbound SSL is also set by IIS local TLS settings, so if I want to speak on TLS to the SharePoint server, I also need to have SSL enabled (or registry hacked) on TLS1.2 on the IIS VM hosting my console.
3.> My Console needs to support TLS 1.2 or all versions so it can negotiate for itself. Regedit to check TLS setting is shown below:
More Info:
https://www.sysadmins.lv/blog-en/test-web-server-ssltls-protocol-support-with-powershell.aspx
Also look at this post to enforce TLS1.2
HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\.NETFramework\\v4.0.30319
Initial Hypothesis: The outbound HTTPS traffic is the issue as the error is telling me that the mistake was creating the SSL client credential. The console runs on a web server, and the TLS restriction change has caused the issue. This issue is that the console running can't create an SSL client credential. The TLS change was made to the console VM and not the SharePoint farm. Here is the PS script to validate TLS versions written by Vadims Podans.
The post below helped me query the windows web servers to check the TLS settings using PowerShell. I believe the outbound is controlled by the inbound TLS settings.
Resolution: Change the console to use a know TLS version e.g., TLS1.2 as shown below:
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
Alternatively, revert the TLS setting in the registry. Apparently, this means your server is more susceptible to attack.Alternatively, specify all the portocols you support from the calling client side application ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls | SecurityProtocolType.Ssl3;
Read this section if you are still having issues.
Factors that Influence Settings:
My CSOM console sits on a VM that hosts IIS, so there are three components to ensure connectivity excluding networking:
1.> SharePoint Server needs to support the TLS version
2.> VM hosting my console's outbound SSL is also set by IIS local TLS settings, so if I want to speak on TLS to the SharePoint server, I also need to have SSL enabled (or registry hacked) on TLS1.2 on the IIS VM hosting my console.
3.> My Console needs to support TLS 1.2 or all versions so it can negotiate for itself. Regedit to check TLS setting is shown below:
https://www.sysadmins.lv/blog-en/test-web-server-ssltls-protocol-support-with-powershell.aspx
Also look at this post to enforce TLS1.2
HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\.NETFramework\\v4.0.30319
SchUseStrongCrypto = (DWORD): 00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\\.NETFramework\\v4.0.30319
SchUseStrongCrypto = (DWORD): 00000001
0 comments:
Post a Comment