TLS 1.3 with .Net Framework 4.8?

[SonaSteve]

I'm trying to connect to an 8.0 server with TLS 1.3 using a custom app written with .Net Framework 4.8. However, I get an exception that:

System.InvalidOperationException: 'Unexpected character '3' for TLS minor version.'

When I look at the code (

MySqlConnector/src/MySqlConnector/Core/ConnectionSettings.cs

Line 76 in 6bd719c

#if NETCOREAPP3_0_OR_GREATER

), it looks like 1.3 is only enabled if #if NETCOREAPP3_0_OR_GREATER - so does that mean I can't use TLS 1.3? Any plans for this to changed or reasons for the limitation? I think .Net Framework 4.8 supports TLS 1.3 (https://learn.microsoft.com/en-us/dotnet/framework/network-programming/tls)

Thanks,
Steve

[bgrainger]

SslProtocols.Tls13 was added in net48; I wonder if this needs to be fixed by adding support for that TFM. (I'm assuming a net48 build pulls in the net471 package.)

Does it work if you leave the Tls Version setting out of the connection string and just try to use the defaults? The default is SslProtocols.None which is defined as "Allows the operating system to choose the best protocol to use, and to block protocols that are not secure." I believe MySqlConnector's use of SslStream should just follow that logic.

[SonaSteve]

Thanks for the testing. Could we add a net48 condition to that if to allow that framework version to also to use the 1.3? When you mention that you connected to a TLS 1.3 server and it didn't use TLS 1.3, did you force that as the only TLS version listed in the connection string or did you use the default and it sounds like it used TLS 1.2 (or earlier) to connect?

[bgrainger]

When I tried to force it, it threw an exception (because it couldn't negotiate a secure connection with the requested TLS version). When I used the defaults, it fell back to TLS 1.2. (This was for both net481 and net7.0 on Windows 10.)

[bgrainger]

When I added the net48 TFM, I still got a SEC_E_ALGORITHM_MISMATCH exception when trying to connect to my server with TLS 1.3.

[bgrainger]

This happened both with Azure Database for MySQL 8.0.32 and a local mysql:8.0.34 Docker image. Not sure if there's a different server out there that would support TLS 1.3 with a Windows 10 client, but so far it's looking like adding the net48 TFM wouldn't help at all.

[bgrainger]

I have a solution. First, I had to enable client support for TLS 1.3 in Windows 10 with these registry keys: https://stackoverflow.com/a/59210166/23633

Once I did that, connecting to a MySQL Server did use the TLS 1.3 protocol (with both net481 and net7.0 clients using MySqlConnector 2.2.7).

However, if I added ;TlsVersion=Tls13 to the connection string and tried to explicitly select that protocol version, the application crashed with Win32Exception (0x80090304): The Local Security Authority cannot be contacted. A similar issue was reported here (but not reproduced and resolved): dotnet/runtime#53537.

Thus, my recommendation would be:

• enable TLS 1.3 in registry
• use MySqlConnector 2.2.7 with your .NET Framework 4.8.1 program
• don't set TlsVersion in the connection string
• a new version of MySqlConnector that supports the TlsVersion=Tls13 option on .NET Framework isn't necessary