SSL and Outdated TLS(1.0 and 1.1) for Web Service

Question

As per PCI, we need to stop using SSL and TLS(1.0 and 1.1 in certain implementation) from June 30th 2016 as per http://blog.securitymetrics.com/2015/04/pci-3-1-ssl-and-tls.html

We have an client application build on .Net 3.5 which uses HttpWebRequest object to connect to web services.

As per MSDN SecurityProtocolType(https://msdn.microsoft.com/en-us/library/system.net.securityprotocoltype(v=vs.110).aspx) supports only Ssl3 and Tls(1.0) on .Net Framework 4 or below. Tls11 and Tls12 are only supported in .Net Framework 4.5/4.6

Does that mean to be inside Cardholder data environment and fully pci compliant, we need to upgrade all applications to .Net 4.5/4.6 and allow only Tls12 SecurityProtocolType to connect to external web services using HttpWebRequest?

Answer 1

Any communication channel that currently uses SSL/early TLS or that is willing to accept them on negotiation and that is part of the cardholder data environment as a security control needs to be changed such that it will only use TLS 1.1 (with an approved cipher suite) or above.

You need to recompile under .Net 4.5 or greater (TLS 1.2 is not enabled by default so code changes are needed) or use a 3rd party library that supports the required protocols.

Note that if you know your system is using SSL/early TLS you must created a risk mitigation plan/document.

INFORMATION SUPPLEMENT Migrating from SSL and Early TLS

Answer 2

The one thing they don't seem to have done, is update wsdl.exe to support TLS1.1 or 1.2. This is what happens if you try and point wsdle.exe form .Net 4.7 at a web service that doesn't support TLS1.0:

Microsoft (R) Web Services Description Language Utility
[Microsoft (R) .NET Framework, Version 4.7.2558.0]
Copyright (C) Microsoft Corporation. All rights reserved.
Error: There was an error processing 'http://<some.domain>/_vti_bin/Authentication.asmx?wsdl'.
  - There was an error downloading 'http://<some.domain>/_vti_bin/Authentication.asmx?wsdl'.
  - The underlying connection was closed: An unexpected error occurred on a send.
  - Authentication failed because the remote party has closed the transport stream.

This is causing me some real issues, and just stunned that this app has still not been updated!

Answer 3

Actually, you can use TLS 1.2 in Frameworks lower than 4.5 (at least I managed it in .NET Framework 4 client). Instead of using the classic command in order to set the Protocol as Tls12, you can bypass it by using the id for this protocol.

  ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;

Answer 4

Microsoft have done the unthinkable and published patches for this

• KB3154518 - Reliability Rollup HR-1605 - NDP 2.0 SP2 - Win7 SP1/Win 2008 R2 SP1
• KB3154519 - Reliability Rollup HR-1605 - NDP 2.0 SP2 - Win8 RTM/Win 2012 RTM
• KB3154520 - Reliability Rollup HR-1605 - NDP 2.0 SP2 - Win8.1RTM/Win 2012 R2 RTM
• KB3156421 - 1605 HotFix Rollup through Windows Update for Windows 10.