title: C# and dotnet 4.7.1 not adding custom certificate for TLS 1.2 calls
body: <p>I have the following C# code, constructing an https call with a custom certificate. When using Tls 1.1, the call works fine. When using Tls 1.2 the call breaks. I using curl, using tls 1.2 works fine as well.</p>
  
  <p>C# Code:</p>
  
  <pre><code>X509Certificate2Collection collection = new X509Certificate2Collection();
  collection.Import("C:\\SomePath\\MyCertificate.pfx", "MyPassword", X509KeyStorageFlags.PersistKeySet);
  var cert = collection[0];
  
  ServicePointManager.SecurityProtocol = ...;
  
  ServicePointManager.ServerCertificateValidationCallback += (sender, certificate, chain, errors) =&gt; true;
  HttpClientHandler handler = new HttpClientHandler();
  handler.ServerCertificateCustomValidationCallback = (message, certificate2, arg3, arg4) =&gt; true;
  handler.ClientCertificates.Add(cert);
  
  var content = new ByteArrayContent(Encoding.GetEncoding("latin1").GetBytes("Hello world"));
  HttpClient client = new HttpClient(handler);
  var resp = client.PostAsync(requestUri: url, content: content).Result.Content.ReadAsStringAsync().Result;
  </code></pre>
  
  <p>Works with:</p>
  
  <pre><code>ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11;
  </code></pre>
  
  <p>Error with:</p>
  
  <pre><code>ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
  </code></pre>
  
  <p>.Net error message: <em>SocketException: An existing connection was forcibly closed by the remote host</em></p>
  
  <p>.Net version : 4.7.1</p>
  
  <p>OS: Windows 10 version 1703 (supported cipher list: <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/mt808163(v=vs.85).aspx" rel="nofollow noreferrer">https://msdn.microsoft.com/en-us/library/windows/desktop/mt808163(v=vs.85).aspx</a>) - and the server specifies TLS_RSA_WITH_AES_256_GCM_SHA384 to be used, which is among the supported ciphers.</p>
  
  <p>In wireshark I can see that with the working calls (C#/Tls 1.1 and Curl Tls 1.2) the certificate is being sent to the server. Here is the wireshark dump for the C# tls 1.1 call:</p>
  
  <p><a href="https://i.stack.imgur.com/DRiZc.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DRiZc.png" alt="Wireshark dump - Csharp tls 1.1"></a></p>
  
  <p>However, also in wireshark, I can see that with C#/Tls 1.2 there is no certificate being sent from the client to the server. Here is the wireshark dump for the C# tls 1.2 call:</p>
  
  <p><a href="https://i.stack.imgur.com/3MqOo.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/3MqOo.png" alt="enter image description here"></a></p>
  
  <p>Can anyone see what I am missing here?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>It seems the certificate has an md5 signature which is not supported by Schannel in windows in combination with tls 1.2. Our vendor has created another certificate to us as a solution.</p>
  
  <p>I came across this random thread that discusses the issue: <a href="https://community.qualys.com/thread/15498" rel="nofollow noreferrer">https://community.qualys.com/thread/15498</a></p>