2

We are getting an error in the SChannel Event log: “An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.”

We have verified that we support all of the ExactTarget ciphers except the two marked as Weak:

TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) TLS_RSA_WITH_AES_256_CBC_SHA (0x35) TLS_RSA_WITH_RC4_128_SHA (0x5) WEAK TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH 256 bits (eq. 3072 bits RSA) FS TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH 256 bits (eq. 3072 bits RSA) FS TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH 256 bits (eq. 3072 bits RSA) FS TLS_RSA_WITH_RC4_128_MD5 (0x4) WEAK

I found an interesting answer on Stack Exchange: Ensuring my application complies with SSL3.0 being disabled?

We did, in fact, implement a solution: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls

rather than: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;

The above answer also gives a reference to https://help.salesforce.com/apex/HTViewSolution?urlname=Salesforce-disabling-SSL-3-0-encryption&language=en_US

Which suggests that all ExactTarget servers should support TLS 1.0 and TLS1.2

Q: Which non-SSL 3.0 encryption protocols does Salesforce support?

A: Salesforce currently supports the following encryption protocols:

For inbound requests: TLS 1.0, and TLS 1.2

For outbound requests: TLS 1.0

So, we should not get a failure when using this: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls

However, would you recommend that we make the change to explicitly enable TLS 1.2 by changing to this: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;

  • So you are seeing this log message in IIS, correct? Do you know who or what is making the inbound request? – Daniel Ballinger Mar 26 '15 at 2:00
  • This is an intermittent problem. We resolved the earlier intermittent problem with SSL V3 as stated above, which happened frequently as stated above when making the following request: – Graham Lawes Mar 26 '15 at 13:51
  • The earlier problem happened frequently as stated above when making a request to webservice.exacttarget.com/Service.asmx and fixed by forcing TLS - <CreateRequest xmlns="exacttarget.com/wsdl/partnerAPI"> <Options> <SaveOptions> <SaveOption> <PropertyName>*</PropertyName> <SaveAction>UpdateAdd</SaveAction> We then received the above error after about 600 triggered sends. This error is from System Event Log - SChannel. We have re-enabled verbose logging and are monitoring to detect further occurrences. – Graham Lawes Mar 26 '15 at 14:04
  • I just found that we are using .NET 4.0 so that the construct: System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12; is not supported. Do you think this intermittent issue would go away if we upgraded to .NET 4.5.2? – Graham Lawes Mar 26 '15 at 15:55
  • Just to be clear, you are getting intermittent failures calling the ExactTarget partner API where the SSL connection fails? I'm not sure you can assume that the ExactTarget APIs have the same support as the core Salesforce APIs. Maybe you could create a one off .NET 4.5.2 app and try verifying individual Security protocol support. E.g. Try with only Tls12 on. – Daniel Ballinger Mar 26 '15 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.