How to enforce TLS 1.0 using WinInet?

[Javier Liceaga]

I am writing a client application (C++, no C# or .NET) that needs to
communicate with a published service in a server. The communication
needs to be secure (TLS 1.0) and the server identity is validated with
a server-side certificate. There is no client-side certificate.

I am newbie at all this so I thought I could just use the
CSoapWininetClient class to communicate with the service over HTTP.
Communication with the server works fine but the CSoapWininetClient
defaults to using the protocols defined in the Internet Explorer
registry settings (which have TLS 1.0 turned off by default). But I
want to use TLS 1.0 exclusively, without changing the user's Internet
Explorer registry settings.

At this point, I believe that I cannot use CSoapWininetClient. Can
somebody guide me in the steps needed to implement this?

[Stephen Sulzer]

I do not believe WinInet has an API option to allow the app to
programmatically specify what SSL protocols (SSL3, TLS1.0, etc.) to use for
a request. The only way to tell WinInet to use TLS1.0 is via the IE
Tools/Internet Options menu, which sets the Internet Explorer
'SecureProtocols' registry key, which is not what you want. So I don't think
you have a solution using WinInet.

However, the WinHTTP API (which is similar to WinInet) does support an
option (called the SECURE_PROTOCOLS option) which lets the application
specify what SSL protocols to use. Perhaps you can use WinHTTP instead.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winhttp/http/winhttp_start_page.asp


Stephen

Post by Javier Liceaga
I am writing a client application (C++, no C# or .NET) that needs to
communicate with a published service in a server. The communication
needs to be secure (TLS 1.0) and the server identity is validated with
a server-side certificate. There is no client-side certificate.
I am newbie at all this so I thought I could just use the
CSoapWininetClient class to communicate with the service over HTTP.
Communication with the server works fine but the CSoapWininetClient
defaults to using the protocols defined in the Internet Explorer
registry settings (which have TLS 1.0 turned off by default). But I
want to use TLS 1.0 exclusively, without changing the user's Internet
Explorer registry settings.
At this point, I believe that I cannot use CSoapWininetClient. Can
somebody guide me in the steps needed to implement this?

[Javier Liceaga]

Thank you for the help.

I will try using WinHTTP instead.

[David Whitman]

This post might be inappropriate. Click to display it.