title: SSL and Outdated TLS(1.0 and 1.1) for Web Service client application on .Net 3.5
body: <p>As per PCI, we need to stop using SSL and TLS(1.0 and 1.1 in certain implementation) from June 30th 2016 as per 
  <a href="http://blog.securitymetrics.com/2015/04/pci-3-1-ssl-and-tls.html">http://blog.securitymetrics.com/2015/04/pci-3-1-ssl-and-tls.html</a></p>
  
  <p>We have an client application build on .Net 3.5 which uses HttpWebRequest object to connect to web services.  </p>
  
  <p>As per MSDN SecurityProtocolType(<a href="https://msdn.microsoft.com/en-us/library/system.net.securityprotocoltype(v=vs.110).aspx">https://msdn.microsoft.com/en-us/library/system.net.securityprotocoltype(v=vs.110).aspx</a>) supports only Ssl3 and Tls(1.0) on .Net Framework 4 or below. Tls11 and Tls12 are only supported in .Net Framework 4.5/4.6</p>
  
  <p>Does that mean to be inside Cardholder data environment and fully pci compliant, we need to upgrade all applications to .Net 4.5/4.6 and allow only Tls12 SecurityProtocolType to connect to external web services using HttpWebRequest? </p>