"The request was aborted: Could not create SSL/TLS secure channel" When hitting the API for first time

Question

I am trying to consume Client's Web Service from Web API, Below is the code we are currently using to bypass SSL certificate

ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, sslPolicyErrors) => true;

It was working fine, until they disabled TLS 1.0 and TLS 1.1 from their end. Now we have added follwing code to use TLS 1.2 for client server connection

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12; ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, sslPolicyErrors) => true;

Now i am getting "The request was aborted: Could not create SSL/TLS secure channel." Error only when i am hitting the API for first time, and then getting results if i am continuously hitting the API, If i wait for some time like a minute or so, Again getting same error for first time only.

What framework are you using and where in the application do you set the ServicePointManager.SecurityProtocol? — martennis
– martennis, Commented Apr 19, 2019 at 12:41
Can you disable ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, sslPolicyErrors) => true; and debug the callback to review the sslPolicyErrors? This may give you some insight into the issue. — Stinky Towel
– Stinky Towel, Commented Apr 19, 2019 at 12:47
Hi Martennis, i am using framework 4.5.2, we are using proxy class generated from wsdl and setting ServicePointManager.SecurityProtocol just before calling their method. — Soniya
– Soniya, Commented Apr 19, 2019 at 12:55
Hi Stinky, Debugging is not an option from us , Only one IP is whitelisted for Service, we do not have dev environment there, though i tried accessing the Service from SOAPUI 5.4.0 , getting below error for first request only there as well ERROR:javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure — Soniya
– Soniya, Commented Apr 19, 2019 at 12:59
@Soniya - if can't debug, how are you able to update the ServicePointManager? — Stinky Towel
– Stinky Towel, Commented Apr 19, 2019 at 13:01

Dharman · Accepted Answer · 2019-11-11 23:35:00Z

17

Setting the security protocol type needs to be done before the issuing request is created. So this:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

Should appear before this:

HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);

So if you're seeing it work on subsequent requests, it might be that you're setting the protocol too late.

edited Nov 11, 2019 at 23:35

Dharman♦

33.9k27 gold badges106 silver badges157 bronze badges

answered Nov 11, 2019 at 19:45

chill_cat

1711 silver badge3 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Shane Over a year ago

@RushabhMaster you should accept the answer then so they get credit.

Rushabh Master Over a year ago

@Shane, The initial question was not initiated by me, I upvoted the answer as it worked in my case, Thanks for your comment though!

SHEKHAR SHETE Over a year ago

This worked for me plus one

Stinky Towel · Accepted Answer · 2019-04-19 14:17:04Z

4

The following code can be used to help troubleshoot the issue.

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;
ServicePointManager.ServerCertificateValidationCallback += ValidateServerCertificate;

...

private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    // If the certificate is a valid, signed certificate, return true to short circuit any add'l processing.
    if (sslPolicyErrors == SslPolicyErrors.None)
    {
        return true;
    }
    else
    {
        // cast cert as v2 in order to expose thumbprint prop - if needed
        var requestCertificate = (X509Certificate2)certificate;

        // init string builder for creating a long log entry
        var logEntry = new StringBuilder();

        // capture initial info for the log entry
        logEntry.AppendFormat("SSL Policy Error(s): {0} - Cert Issuer: {1} - SubjectName: {2}",
           sslPolicyErrors.ToString(),
           requestCertificate.Issuer,
           requestCertificate.SubjectName.Name);

        // check for other error types as needed
        if (sslPolicyErrors == SslPolicyErrors.RemoteCertificateChainErrors) //Root CA problem
        {
            // check chain status and log
            if (chain != null && chain.ChainStatus != null)
            {
                // check errors in chain and add to log entry
                foreach (var chainStatus in chain.ChainStatus)
                {
                    logEntry.AppendFormat("|Chain Status: {0} - {1}", chainStatus.Status.ToString(), chainStatus.StatusInformation.Trim());
                }
            }
        }

        // replace with your logger
        MyLogger.Info(logEntry.ToString().Trim());
    }

    return false;
}

answered Apr 19, 2019 at 14:17

Stinky Towel

7787 silver badges26 bronze badges

1 Comment

Suncat2000 Over a year ago

The result of returning false when use in conjunction with HttpWebRequest is a WebException with an associated Status of WebExceptionStatus.TrustFailure.

Peter Csala · Accepted Answer · 2020-10-09 14:01:23Z

1

For those running .NET version 4, they can use below

ServicePointManager.SecurityProtocol = CType(768, SecurityProtocolType) Or CType(3072,SecurityProtocolType)
ServicePointManager.Expect100Continue = True

edited Oct 9, 2020 at 14:01

Peter Csala

23.7k16 gold badges51 silver badges96 bronze badges

answered Jan 14, 2020 at 11:07

Vikky

7643 gold badges16 silver badges37 bronze badges

Collectives™ on Stack Overflow

"The request was aborted: Could not create SSL/TLS secure channel" When hitting the API for first time

3 Answers 3

3 Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related