How does ServicePointManager.SecurityProtocol work?

Question

I would like to know how the property ServicePointManager.SecurityProtocol works when I set three different SecurityProtocolType on her flags. Ie.,

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls12 | SecurityProtocolType.Ssl3;

Will the communication try first to communicate with TLS, and if it fails try TLS1.2 and after SSL3?

If not, what do these flags mean and how does it work?

Answer 1

Whichever communication object you're using (HttpClient, HttpWebRequest, etc) will try to negotiate to the highest level possible first. Failing that it will keep going "down" the chain.

If you're using .Net 4.6 then the default security protocols will look like this because SSL3 is broken:

SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12

If you really need to use SSL3 for some reason and are using .Net 4.6, see this MS KB article on how to force it to be insecure: https://support.microsoft.com/en-us/kb/3069494

You might also be asking how this protocol level is actually determined? This is step 1 of the SSL handshake process where each end of the connection says "I support this version". Here is an interesting read on the full handshake process: http://www.truedigitalsecurity.com/blog/2015/05/20/ssltls-protocol-version-negotiation/