title: ASP NET Core Web API disable TLS 1.0 and TLS 1.1 support
body: <p>I am trying to disable the TLS 1.0 and TLS 1.1 support for an API running on docker (Debian OS) and .NET 5. I found this code related to this specific problem:</p>
  <pre><code>     public static IHostBuilder CreateHostBuilder(string[] args) =&gt;
          Host.CreateDefaultBuilder(args)
              .ConfigureWebHostDefaults(webBuilder =&gt;
                  {
                      webBuilder.ConfigureKestrel(opt =&gt;
                      {
                          opt.ConfigureHttpsDefaults(s =&gt;
                          {
                              s.SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13;
                          });
                      }).UseStartup&lt;Startup&gt;();
                  }
              );
  </code></pre>
  <p>However, when publishing the changes, I am running a script to determine if the TLS1.0 and TLS1.1 are still supported by the server, and surprisingly although I am explicitly setting the HTTPS defaults to TLS1.2 and TLS1.3 I get the following results:
  <a href="https://i.stack.imgur.com/qM580.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qM580.png" alt="enter image description here" /></a></p>
  <p>here is the Powershell script:</p>
  <pre><code> $HostName = 'YOUR_URL'
   $Port = '443'
   
   $RetValue = New-Object psobject -Property @{
              Host = $HostName
              Port = $Port
              SSLv2 = $false
              SSLv3 = $false
              TLSv1_0 = $false
              TLSv1_1 = $false
              TLSv1_2 = $false
              TLSv1_3 = $false
              KeyExhange = $null
              HashAlgorithm = $null
          }
          &quot;ssl2&quot;, &quot;ssl3&quot;, &quot;tls&quot;, &quot;tls11&quot;, &quot;tls12&quot;,&quot;tls13&quot; | %{
              $TcpClient = New-Object Net.Sockets.TcpClient
              $TcpClient.Connect($RetValue.Host, $RetValue.Port)
              $SslStream = New-Object Net.Security.SslStream $TcpClient.GetStream(),
                  $true,
                  ([System.Net.Security.RemoteCertificateValidationCallback]{ $true })
              $SslStream.ReadTimeout = 15000
              $SslStream.WriteTimeout = 15000
              try {
                  $SslStream.AuthenticateAsClient($RetValue.Host,$null,$_,$false)
                  $RetValue.KeyExhange = $SslStream.KeyExchangeAlgorithm
                  $RetValue.HashAlgorithm = $SslStream.HashAlgorithm
                  $status = $true
              } catch {
                  $status = $false
              }
              switch ($_) {
                  &quot;ssl2&quot; {$RetValue.SSLv2 = $status}
                  &quot;ssl3&quot; {$RetValue.SSLv3 = $status}
                  &quot;tls&quot; {$RetValue.TLSv1_0 = $status}
                  &quot;tls11&quot; {$RetValue.TLSv1_1 = $status}
                  &quot;tls12&quot; {$RetValue.TLSv1_2 = $status}
                  &quot;tls13&quot; {$RetValue.TLSv1_3 = $status}
              }
              # dispose objects to prevent memory leaks
              $TcpClient.Dispose()
              $SslStream.Dispose()
          }
          $RetValue
  </code></pre>
  <p>Is this a bug on Kestrel Configuration? Can I do something else to disable TLS1.0 and TLS1.1 encryptions?</p>
  <p><strong>EDIT</strong> This is the original issue that I am trying to solve:</p>
  <p><em>The remote service accepts connections encrypted using TLS 1.0. TLS 1.0 has a number of cryptographic design flaws. Newer versions of TLS are designed against these flaws and should be used whenever possible.
  PCI DSS v3.1 requires that TLS 1.0 be disabled entirely by June 2018, except for point-of-sale terminals and their termination points.
  As of March 31, 2020, Endpoints that aren't enabled for TLS 1.2 and higher will no longer function properly with major web browsers and major vendors.</em></p>