We have an application that we are trying to get to communicate to Paypal. We noticed that communication failures were occurring, so we routed everything through Charles as a proxy. When we routed the application through Charles, the application worked. I investigated the network traffic and it appears that Charles will initiate the SSL communication channel over TLS 1.2.

enter image description here

When Charles was not being the proxy, the application tries to use TLS 1.0 and it fails at the Client Hello message.

I decided to disable TLS 1.0 on the server by disabling it in IE and changing the TLS 1.0 registry keys DisabledByDefault = 0 and Enabled = 0. When I do this and reboot the server and run the application, I see communication to the Paypal servers, but no client handshake and the application fails.

enter image description here

So I'm at a loss as to why the Client Hello message would be sent with TLS 1.0 and the TLS 1.1 and 1.2 won't send the hello message. I've tried both '1' and 'ffffffff' as the Enabled key and neither seem to work. Any trick to disabling 1.0 and getting 1.1 / 1.2 working?

  • 1
    Ask the software vendor/dev ? Seem a bug in their app, and without the app name we cant do nothing – yagmoth555 Jun 21 '16 at 13:35
  • It's Dynamics NAV, which is why I'm a bit perplexed. I'm a .net programmer, and can't recall a way to force which version of SSL to use. I always thought it was a system setting and not something code could control. – Josh Jun 21 '16 at 14:10
  • Applications can use different SSL libraries and support different protocol versions and cipher suites. Worth noting that www.paypal.com does accept TLS 1.0 so I wonder if the application is using some weird ciphers which the Paypal servers don't like. – Mark Riddell Jun 21 '16 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.