title: The request for security token could not be satisfied because authentication failed when turning off TLS 1.0
body: <p>So I am attempting to turn off TLS 1.0 and 1.1 on my server. When I switch off TLS 1.0 I get the following error in my application:</p>
  
  <pre><code>System.ServiceModel.Security.SecurityNegotiationException: The caller was not authenticated by the service. ---&gt; System.ServiceModel.FaultException: The request for security token could not be satisfied because authentication failed.
     at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target)
     at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState)
  </code></pre>
  
  <p>When TLS 1.0 is enabled everything works fine.</p>
  
  <p>Now the code calling the service is specifying TLS 1.2 using the <code>ServicePointManager</code> with the following code: <code>ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;</code></p>
  
  <p>The service on the other end is running .Net 4.6.2 and does not specify a TLS protocol using the <code>ServicePointManager</code>, so from what I have read it will automatically detect which TLS protocol is required at runtime in this version of the .net framework.</p>
  
  <p>The Web.config for the WCF services are the following in regards to the bindings</p>
  
  <p><strong>Calling Config:</strong>    </p>
  
  <pre><code>&lt;basicHttpBinding&gt;
      &lt;binding name="MyBinding" closeTimeout="00:02:00" openTimeout="00:02:00" receiveTimeout="00:02:00" sendTimeout="00:02:00"/&gt;
  &lt;/basicHttpBinding&gt;
  &lt;netTcpBinding&gt;
      &lt;binding name="CrossDomainBinding"&gt;
            &lt;security mode="Message"&gt;
                &lt;message clientCredentialType="Certificate"/&gt;
            &lt;/security&gt;
      &lt;/binding&gt;
  &lt;/netTcpBinding&gt;
  &lt;client&gt;
      &lt;endpoint address="net.tcp://MyService.svc"
      binding="netTcpBinding" bindingConfiguration="CrossDomainBinding" behaviorConfiguration="CrossDomainBehavior"
      contract="MyContract" name="MyBinding"&gt;
          &lt;identity&gt;
              &lt;certificate encodedValue="CERTIFICATEENCODEDVALUE" /&gt;
          &lt;/identity&gt;
      &lt;/endpoint&gt;
  &lt;/client&gt;
  </code></pre>
  
  <p><strong>Service Config:</strong></p>
  
  <pre><code>&lt;bindings&gt;
      &lt;netTcpBinding&gt;
          &lt;binding&gt;
              &lt;security mode="Message"&gt;
                  &lt;message clientCredentialType="Certificate"/&gt;
              &lt;/security&gt;
          &lt;/binding&gt;
      &lt;/netTcpBinding&gt;
  &lt;/bindings&gt;
  &lt;behaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior name="MyBehaviour"&gt;
        &lt;serviceMetadata httpGetEnabled="false" httpsGetEnabled="false"/&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
        &lt;serviceCredentials&gt;
          &lt;serviceCertificate findValue="MyCertificate" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/&gt;
        &lt;/serviceCredentials&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  </code></pre>
  
  <p>I cannot for the life of me work out what the issue is here. </p>
  
  <p>Does anyone have any idea why when turning off TLS 1.0 this does not work?</p>