We have an application that downloads https://www.rba.gov.au/rss/rss-cb-exchange-rates.xml daily to get exchange rates. It stopped working a few days ago, we found that above URL doesn't open in IE while it does in Chrome.
My understanding is that the App, which is developed using .NET framework, would certainly use the same thing under the hood as IE, thus it couldn't download the file either.
Below is the error I get when visiting the site using IE, I'm sure that all TLS version are enabled: enter image description here

And below is the error I get when I try to download the file through powershell/.net: enter image description here

Then I tested the url using ssllabs.com and got the following result. It says fatal error is ruturned if client is IE11/Win 8 (I believe Windows 2012 and Windows 8 belong to the same family, so fatal error would occur to server 2012 too). enter image description here

But I'm thinking there must be something I can do, some setting I can change to fix this issue? I would like to avoid Upgrading the OS to server 2016 just for this issue. Your help is greatly appreciated.

  • That's Enhanced Security for you: not an exact science. I were you, I'd disable it from Server Manager for Admin and other user accounts with admin rights, just to check if your problem is solved. – user1019780 Mar 29 '20 at 9:28
  • I just checked enhanced security setting, it is off. So I don't think that's the case. – SparedWhisle Mar 29 '20 at 9:31

Based on the SSLLabs report the only two ciphers supported by the server are TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Based on the information from Microsoft these ciphers are not supported by Windows 8.1 and 2012.

But I'm thinking there must be something I can do, some setting I can change to fix this issue?

Unfortunately not. Your are facing inherent limitations of the OS you use combined with a broken server setup (too few usable ciphers, domain has IPv6 address but SSL on IPv6 fails). You can install a different browser like Chrome or Firefox though to access the site since these browsers come with their own TLS stack which supports these ciphers.

  • Hmm. I certainly did not expect that this is not possible. – SparedWhisle Mar 29 '20 at 9:32
  • 1
    @DavidDai: Again, these limitations are specific to the build-in TLS stack which is unfortunately used by .NET too. If you use OpenSSL/BoringSSL as Chrome does or NSS as Firefox does then you don't have these limitations. – Steffen Ullrich Mar 29 '20 at 9:39
  • Thank you. I still find it a bit a hard to believe that there's no way to add additional cipher support to Windows. – SparedWhisle Mar 29 '20 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.