We are getting an error in the SChannel Event log: “An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.”
We have verified that we support all of the ExactTarget ciphers except the two marked as Weak:
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) TLS_RSA_WITH_AES_256_CBC_SHA (0x35) TLS_RSA_WITH_RC4_128_SHA (0x5) WEAK TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH 256 bits (eq. 3072 bits RSA) FS TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH 256 bits (eq. 3072 bits RSA) FS TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH 256 bits (eq. 3072 bits RSA) FS TLS_RSA_WITH_RC4_128_MD5 (0x4) WEAK
I found an interesting answer on Stack Exchange: Ensuring my application complies with SSL3.0 being disabled?
We did, in fact, implement a solution: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls
rather than: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;
The above answer also gives a reference to https://help.salesforce.com/apex/HTViewSolution?urlname=Salesforce-disabling-SSL-3-0-encryption&language=en_US
Which suggests that all ExactTarget servers should support TLS 1.0 and TLS1.2
Q: Which non-SSL 3.0 encryption protocols does Salesforce support?
A: Salesforce currently supports the following encryption protocols:
For inbound requests: TLS 1.0, and TLS 1.2 For outbound requests: TLS 1.0
So, we should not get a failure when using this: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls
However, would you recommend that we make the change to explicitly enable TLS 1.2 by changing to this: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;