Disable insecure renegotiation in SslStream
.net, c#, ssl
Solution
SslStream uses SChannel.dll under the hood. You can configure which algorithms are available by modifying the registry:
http://support.microsoft.com/kb/245030
In particular, the two entries highlighted in the following screenshot will disallow TLS renegotiation:
They are called `AllowInsecureRenegoClients` and `AllowInsecureRenegoServers`, are both DWORD values, both set to 0, and located in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`.
Apparently there is a hotfix you can install do disable insecure TLS/SSL renegotiation too (only applicable to Windows XP/Windows2003 server):
http://support.microsoft.com/kb/980436/en-us
Problem
I wrote a webserver in .NET that supports HTTPS by using an `SslStream`. Unfortunately, ssllabs.com outputs the following message about my implementation: This server is vulnerable to MITM attacks because it supports insecure renegotiation. This links to an interesting blog entry about the vulnerability. How do I disable renegotiation in .NET’s `SslStream`?