A third-party service has recently updated its server to use only TLS 1.2 with a limited number of cipher suites. My server, acting as the client in this case, is not able to communicate with the service as the following error is received:
Could not create SSL/TLS secure channel
This error message is in response to a request being made from a .NET Framework 4.8 application. I understand .NET Framework 4.8 supports TLS 1.2. The TLS version has not been hardcoded in this application.
My server is running Windows Server 2012 R2 with all updates, TLS 1.2 is enabled and I have used IIS Crypto to enable the following additional two cipher suites that the service I am trying to connect to also supports:
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
Using Wireshark to see the 'Client Hello', I can see that it lists 16 other cipher suites that are also enabled but it does not list the two cipher suites above, even though they appear to be available on my server.
Are there any further steps required in order for my server to use one of these two cipher suites and make them available in the 'Client Hello'?
Edit: I have also updated the DH modulus size (for both server and client settings) to 2048 as per this Microsoft advisory but there's still no success.