Add option to support TLS 1.2 (and future versions) for client calls

[cforsyth68]

Expected Behavior

Library should allow consumers to force TLS 1.2

Actual Behavior

Requests are sent based on the .Net Framework targeted. .Net 4.5 default is TLS 1.0 not TLS 1.2. .Net 4.6 default is v1.2. It isn't always possible to refactor legacy code to target 4.6. An option should be provided to allow these clients to force TLS 1.2 using SecurityProtocolType Enumeration

Steps to Reproduce the Problem

1. Write code in .Net 4.5 that calls an endpoint via RESTSharp that does not accept requests other than TLS 1.2

[alexeyzimarev]

RestSharp does not support .NET 4.5 in the latest versions.

[Lechus]

Just enable TLS12 in the code before making a call using RestSharp?

[alexeyzimarev]

I don't think this is relevant for RestSharp. This is a global application-level configuration or even .NET registry setting, which people can change. I don't think we need to include all possible configurations to RestSharp. This should work:

System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

[alaska-adam]

Will we need to continue to add flags for later TLS versions? SecurityProtocolType.Tls13? This doesn't seem like a reasonable long term solution. Upgrading the framework version would accommodate this and not require dependents to hack in support for specific TLS versions. Wouldn't upgrading the framework version also clean up warnings like: "Some NuGet packages were installed using a target framework different from the current target framework and may need to be reinstalled."?

[alexeyzimarev]

@alaska-adam what do you mean by "upgrading the framework version"?

[alaska-adam]

I could be mistaken, but is RestSharp currently using a 5 year old framework of .NET?

Line 3 of RestSharp.csproj
<TargetFrameworks>netstandard2.0;net452</TargetFrameworks>

It is my understanding that this is what is holding people back from using TLS 1.2 "out of the box" when using a newer .NET framework (like the several year old 4.6.1 or last year's 4.7).

[cforsyth68]

Wasn't thus closed as won't fix?

…

On Mon, May 7, 2018, 1:16 PM alaska-adam ***@***.***> wrote: Will we need to continue to add flags for later TLS versions? SecurityProtocolType.Tls13? This doesn't seem like a reasonable long term solution. Upgrading the framework version would accommodate this and not require dependents to hack in support for specific TLS versions. Wouldn't upgrading the framework version also clean up warnings like: "Some NuGet packages were installed using a target framework different from the current target framework and may need to be reinstalled."? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1075 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AHqH1N38Kup5J9-V9Ed8hCjYC4_Mts0-ks5twKuRgaJpZM4RuqO7> .

[Helbo15]

I've been looking for information on how restsharp would handle tls 1.2

it seems that Restsharp won't which is kinda a shame since that, all you really need to do is to change the targetframework to 4.6 or higher in your project configuration. and it will only generate more and more problems for users of Restsharp from now on as tls 1.2 have become the defacto minimum standard for any secure connection online.