Explicit SSL / TLS version selection

Question

I have posted this question in SO but didn't receive any help. Therefore, I am trying my luck here at SE.

In a nutshell, framework such a .NET allow us to switch the SSL/TLS version before we connect to any specific https service. This agreement ensure that both client and server connect and consume http over agreed version of SSL/TLS. As far as I aware, the agreement of SSL/TLS version negotiation happens upon SSL/TLS handshake.

Question: Can someone explain why framework allow such use case when negotiation was suppose to be performed at the stage of TLS handshake?

Answer 1

I think you understand the API wrong. The function you mention is not used to select a specific SSL/TLS version. The argument to a function is a SecurityProtocolType Enum which has the following documentation:

Specifies the security protocols that are supported by the Schannel security package. This enumeration has a FlagsAttribute attribute that allows a bitwise combination of its member values.

Note that it talks about combining multiple values here and not a single protocol version.

In other words: this is not used to select a specific protocol version but to set a list of allowed protocol versions. Typically you want to have TLS 1.2 and higher, maybe TLS 1.1 and TLS 1.0 for compatibility reasons but you don't want to allow SSLv3 or lower. By using this API you can tune which protocols are allowed within the following TLS handshakes.