限制除TLS 1.2服务器端WCF之外的任何内容

Question

我有一个简单的问题但无法在任何地方找到答案.我有一个WCF服务器应用程序.我希望它只使用TLS1.2.

我无法控制客户端,无法编辑计算机上的SCHANNEL设置.

我已经尝试了以下似乎只适用于传出连接(clientside)

System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 

除了每个代码TLS 1.2服务器端,有没有办法限制任何东西？

编辑:我正在使用net.tcp绑定并创建这样的绑定:

private static Binding CreateNetTcpBinding()
    {
        return new NetTcpBinding
        {
            ReceiveTimeout = TimeSpan.FromMinutes(10),

            ReliableSession =
            {
                Enabled = true,
                InactivityTimeout = TimeSpan.FromMinutes(1)
            },
            Security =
            {
                Mode = SecurityMode.Transport,
                Transport =
                {
                    ClientCredentialType = TcpClientCredentialType.Windows,
                    ProtectionLevel = ProtectionLevel.EncryptAndSign,
                    SslProtocols = SslProtocols.Tls12
                },
                Message =
                {
                    AlgorithmSuite = SecurityAlgorithmSuite.xxx <-- not here on purpose,
                    ClientCredentialType = MessageCredentialType.Windows
                }
            }
        };
    }

如果有人可以告诉我在哪里检查当前连接的TLS版本(某些上下文),这也足够了!

先感谢您!

Answer 1

您是否尝试使用ServicePointManager.ServerCertificateValidationCallback。此回调使您有机会自行验证服务器证书。例如，如下所示：

ServicePointManager.ServerCertificateValidationCallback = MyCertHandler; 
    ... 
static bool MyCertHandler(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors error) 
{
     //Your logic here for certificate validation 
}