The request was aborted: Could not create SSL/TSL secure channel

[Brennan1994]

NSIDownloader/NSIDownloader/NSIDownloader/Program.cs

Line 56 in bf3a455

var message = await client.GetAsync(new Uri(NSIURL));

[Brennan1994]

Background: Randy's email from a previous troubleshooting sprint.

This is really painful... i've spent the better part of a day futzing with this and here's what I've learned.

The issue is related to a windows system library, not dot-net per-se. For example, .net core on linux would probably work ok. On windows, .net is using the windows system for cryptographic services and for some reason windows cannot create a valid TLS1.2 session with our WAF (Web Application Firewall). I've verified that all services behind this WAF (much more than just NSI) cannot communicate with older Microsoft products. Safari, Chrome, Firefox, Microsoft Edge (Chromium version) and the TLS clients used by Java and Golang are ok. Pre-chromium Edge, IE, and the windows system libraries are not.

I've inspected the network at a packet level using wireshark, have turned on windows system detailed network logging, and still have not been able to get a definitive cause for the issue. I have verified that the cipher suite used by this WAF is compatible with windows 10, and I've also verified that I can load on IE11 other sites behind different CWBI WAFs using the same cipher, therefore the issue seems to be specific to the WAF in our development account and is not related to cipher compatibility.

At this point, I'm down to coordinating with our sys-admins to figure out what we are doing in the WAF config that affects compatibility with the Windows 10 TLS implementation. It will probably become a trial and error affair of adjusting TLS settings then testing.

Ughhhhh......