title: SSL/TLS errors using cURL (PHP) with a C# REST API and the SslStream class
body: <p>I have written a REST API server in C#, it uses the <code>System.Net.Security.SslStream</code> class to provide SSL/TLS encryption.</p>
  
  <p>I am also creating a web service which uses PHP + cURL to handle communication with the server.</p>
  
  <p>Locally, I am using WAMP as a test environment, and all works fine.</p>
  
  <p>However, upon uploading and testing on a remote environment, communication failed with the following error messages:</p>
  
  <p><strong>cURL Error</strong></p>
  
  <pre><code>Unknown SSL protocol error in connection to mywebsite.example:443
  </code></pre>
  
  <p><strong>SslStream Error</strong></p>
  
  <p><code>AuthenticationException</code> in <code>SslStream.AuthenticateAsServer()</code>:</p>
  
  <pre><code>A call to SSPI failed, see inner exception.
  
  Inner exception: The client and server cannot communicate, because they do not possess a common algorithm
  </code></pre>
  
  <p>This exception and error occurs when attempting to use TLS 1.2 authentication:</p>
  
  <pre><code>SslStream.AuthenticateAsServer(ServerCertificate, false, SslProtocols.Tls12, true);
  </code></pre>
  
  <p>I tried setting various cURL options such as:</p>
  
  <pre><code>    curl_setopt($curl, CURLOPT_SSLVERSION,CURL_SSLVERSION_TLSv1_2);
  </code></pre>
  
  <p>but, alas, no joy.</p>
  
  <p>After checking the <code>phpInfo()</code> configurations for differences, I noticed SSPI was enabled in the cURL settings locally, but not on the remote server:</p>
  
  <p><a href="https://i.stack.imgur.com/HXXA6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HXXA6.png" alt="cURL settings"></a></p>
  
  <p>I know very little about SSPI, in fact, mostly just what is summarised on Wikipedia:</p>
  
  <blockquote>
    <p>Security Support Provider Interface (SSPI) is a Win32 API used by
    Microsoft Windows systems to perform a variety of security-related
    operations such as authentication.</p>
  </blockquote>
  
  <p>So, it seems to make sense that this is the cause of the problem - but...</p>
  
  <p><strong>I managed to achieve successful communication</strong> by changing the <code>SslProtocols</code> type from <code>SslProtocols.Tls12</code> to just <code>SslProtocols.Tls</code>. However, from what I can tell, SSPI is not tied to any particular SSL protocol, so why did this work?</p>
  
  <p>This is a workaround for now, but I would really like to understand the underlying issue causing this problem. Can anyone shed some light on what's going on here?</p>
  
  <p>I would much rather fully support TLS 1.2 and not have to downgrade.</p>