title: Default SecurityProtocol in .NET 4.5
body: <p>What is the default security protocol for communicating with servers that support up to <code>TLS 1.2</code>? Will <code>.NET</code> by default, choose the highest security protocol supported on the server side or do I have to explicitly add this line of code:</p>
  
  <pre><code>System.Net.ServicePointManager.SecurityProtocol = 
  SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;
  </code></pre>
  
  <p>Is there a way to change this default, besides a code change?</p>
  
  <p>Lastly, does <code>.NET 4.0</code> only support up to <code>TLS 1.0</code>? i.e. I have to upgrade client projects to 4.5 to support <code>TLS 1.2</code>.</p>
  
  <p>My motivation is to remove support for <code>SSLv3</code> on the client side even if server supports it (I already have a powershell script to disable this in the machine registry) and to support the highest TLS protocol that the server supports.</p>
  
  <p><strong>Update:</strong>
  Looking at the <code>ServicePointManager</code> class in <code>.NET 4.0</code> I see no enumerated values for <code>TLS 1.0</code> and <code>1.1</code>. In both <code>.NET 4.0/4.5</code>, the default is <code>SecurityProtocolType.Tls|SecurityProtocolType.Ssl3</code>. Hopefully this default won't break by disabling <code>SSLv3</code> in the registry.</p>
  
  <p>However, I've decided I have to upgrade all apps to <code>.NET 4.5</code> and to explicitly add <code>SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;</code> anyway to all bootstrapping code of all applications.</p>
  
  <p>This will make outbound requests to various apis and services to not downgrade to <code>SSLv3</code> and should select the highest level of <code>TLS</code>.</p>
  
  <p>Does this approach sound reasonable or overkill? I have many applications to update, and I want to future proof them since I hear even <code>TLS 1.0</code> may be deprecated in the near future by some providers.</p>
  
  <p>As a client making outbound requests to APIs, does disabling SSL3 in the registry even have an effect in the .NET framework? I see by default, TLS 1.1 and 1.2 are not enabled, do we have to enable it via the registry? RE <a href="http://support.microsoft.com/kb/245030" rel="noreferrer">http://support.microsoft.com/kb/245030</a>. </p>
  
  <p>After a bit of investigation, I believe the registry settings will have no affect since they apply to IIS (server subkey) and browsers (client subkey).</p>
  
  <p>Sorry this post turned into multiple questions, followed up with "maybe" answers.</p>