How to make .NET secure sockets default to TLS 1.2 rather than TLS 1.0

Question

Does anyone know how to force an application using .NET 4.7 to use TLS 1.2 for a secure https request?

I know the client supports TLS 1.2, as I can access the destination https URL fine with Chrome. But the .NET app, using a Microsoft library for talking to an Azure notification hub, is negotiating to use TLS 1.0, which the Azure server stopped supporting at the end of 2020. Packet tracing shows that immediately after the "client Hello" is sent, specifying TLS 1.0, the Azure server immediately closes the socket.

I've followed the instructions here: https://support.microsoft.com/en-us/help/3140245/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-wi

and here:

2008 R2 TLS 1.2 enabled in registry, rebooted, but not functioning

So I have the SCHANNEL enabling TLS 1.1 and TLS 1.2 for Client and Server

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp

and

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp is set to have TLS 1.1 and 1.2 with a new DefaultSecureProtocols DWORD set to 0x0A00.

Still, the Azure code I'm running throws an exception in System.Net.HttpWebRequest. Wireshark shows it is attempting to connect with TLS 1.0.

Answer 1

Lex Li left a comment above that led me to the answer to my question. Here is what I did to fix the issue.
Read the source of this information for more details: https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls

The "fix" is to do two things, and these are accomplished by updating the registry. First, add registry settings to ensure TLS 1.1 and TLS 1.2 are enabled, interestingly by creating the appropriate keys and a DWORD value for "DisabledByDefault" and setting to zero. Apparently, if the appropriate keys and the "DisabledByDefault" do not exist, then they are "disabled by default".

Here are the REG settings to turn these two TLS protocols on by default:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
"DisabledByDefault"=dword:00000000

So now that the OS will allow these protocols by default, the next step is to configure .NET to use these OS settings by default. We do this for both 64 and 32 bit apps. The registry settings for this are as follows:

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001