title: Disabling TLS 1.0 breaks ClickOnce setup
body: <p>We have a White Hat requirement to disable TLS 1.0 on our web server.</p>
  
  <p>However, when we do this we can no longer install ClickOnce applications from the server. The setup.exe downloads, but we get the error below when the setup is started:</p>
  
  <ul>
  <li><p>Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.</p>
  
  <pre><code>- Source: System
  - Stack trace:
      at System.Net.Sockets.NetworkStream.Read()
      at System.Net.FixedSizeReader.ReadPacket()
      at System.Net.Security.SslState.StartReceiveBlob()
      at System.Net.Security.SslState.StartSendBlob()
      at System.Net.Security.SslState.ForceAuthentication()
      at System.Net.Security.SslState.ProcessAuthentication()
      at System.Threading.ExecutionContext.RunInternal()
      at System.Threading.ExecutionContext.Run()
      at System.Threading.ExecutionContext.Run()
      at System.Net.TlsStream.ProcessAuthentication()
      at System.Net.TlsStream.Write()
      at System.Net.ConnectStream.WriteHeaders()
  
  --- Inner Exception ---
  System.Net.Sockets.SocketException
  - An existing connection was forcibly closed by the remote host
  - Source: System
  - Stack trace:
      at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)
  </code></pre></li>
  </ul>
  
  <p>Examining the packets with Wireshark reveals that the setup.exe file is sending a Client Hello message via 1.0. This is the problem because the server can't respond to the 1.0 message.</p>
  
  <p>I understand the requirement to disable TLS is rather newish, but googling on the issue turned up nothing. </p>
  
  <p>Has anyone experienced this before or have any suggestions for a fix?</p>