title: WCF - Could not establish secure channel for SSL/TLS with authority after upgrade to .Net 4.6.1
body: <p>Since upgrading to .Net 4.6.1 I can no longer call a third party web service but get the error  'Could not establish secure channel for SSL/TLS with authority...'. I can workaround this in a couple of ways but I don't find these ways acceptable.
  a) Add the following line to the code:</p>
  
  <pre><code>System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls11 | System.Net.SecurityProtocolType.Tls;
  </code></pre>
  
  <p>This ensures I do not use Tls1.2 and all works as before with .Net 4.5.2</p>
  
  <p>b) Add the following line to my config file</p>
  
  <pre><code>&lt;AppContextSwitchOverrides value="Switch.System.Net.DontEnableSchUseStrongCrypto=true"/&gt;
  </code></pre>
  
  <p>This ensures I do not use Tls1.2 and all works as before with .Net 4.5.2</p>
  
  <p>I would rather be able to use Tls1.2 than turn it off for all calls from my application, my application communicates with many third party services and I don't want to limit all communication because of a problem with one.</p>
  
  <p>Using WireShark to diagnose the problem has highlighted that the client certificate is not sent, which clearly leads to this error.</p>
  
  <p><a href="https://i.stack.imgur.com/qlUj1.png" rel="nofollow noreferrer">WireShark</a></p>
  
  <pre><code>&lt;system.serviceModel&gt;
  &lt;bindings&gt;
      &lt;basicHttpBinding&gt;
          &lt;binding name="def"&gt;
              &lt;security mode="Transport"&gt;
                  &lt;transport clientCredentialType="Certificate"/&gt;
              &lt;/security&gt;
          &lt;/binding&gt;
      &lt;/basicHttpBinding&gt;
  &lt;/bindings&gt;
  &lt;client&gt;
  
      &lt;endpoint address="https://abc" binding="basicHttpBinding" bindingConfiguration="def" contract="ghi" name="jkl"/&gt;
  &lt;/client&gt;
  </code></pre>
  
  <p></p>
  
  <p>The ClientCertificate is set in code</p>
  
  <p>I have read many articles on stackoverflow, the most similar / useful is listed below:
  <a href="https://stackoverflow.com/questions/4090975/how-to-force-wcf-client-to-send-client-certificate">How to force WCF client to send client certificate?</a></p>
  
  <p>I have checked:</p>
  
  <ol>
  <li>Access to the client certificate (private key) is available</li>
  <li>The server certificate is trusted and valid</li>
  <li>The client certificate matches one of the specs the server sent</li>
  <li><p>Converted my binding to a custom binding to specify requireClientCertificate - no effect</p>
  
  <p>
  
      
          
              
              
          
      
  
  </p>
  
  <pre><code>&lt;endpoint address="https://abc" binding="customBinding" bindingConfiguration="def" contract="ghi" name="jkl"/&gt;
  </code></pre>
  
  <p>
  </p></li>
  </ol>
  
  <p>Can anyone point me to anything else I can check or help me understand why my certificate is not sent?</p>
  
  <p><strong>Update 2nd June</strong>
  I can download the wsdl successfully using my client certificate to authenticate in Chrome but not in either Internet Explorer nor Edge!</p>
  
  <p>I believe that Chrome doesn't use SChannel (as Edge and IE do) for TLS but it's own implementation of SSL/ TLS. </p>
  
  <p>While I'm not 100% sure I'm currently considering that the problem is the server is specifying a signature algorithm for the client certificate that doesn't match the clients signature algorithm. I don't really know enough about how TLS 1.2 works to be sure but from a read of the spec tools.ietf.org/html/rfc5246#section-7.4.4 it seems possible.</p>
  
  <p>See Certificate request in wireshark trace - i.stack.imgur.com/BwmUM.png and certificate details - i.stack.imgur.com/pbKEF.png</p>
  
  <p>Any tls1.2 experts out there?</p>