SslStream AuthenticateAsClient override with SslProtocols incorrectly says that the method authenticates with None

[rob-beardsworth]

Type of issue

Other (describe below)

Description

In the Remarks section of the SslStream.AuthenticateAsClient (last override - including the enabledSslProtocols parameter) there is the following:

Starting with .NET Framework 4.7, this method authenticates using None, which allows the operating system to choose the best protocol to use, and to block protocols that are not secure. In .NET Framework 4.6 (and .NET Framework 4.5 with the latest security patches installed), the allowed TLS/SSL protocols versions are 1.2, 1.1, and 1.0 (unless you disable strong cryptography by editing the Windows Registry).

This appears to be a cut and paste from the first 3 overrides which do NOT include the enabledSslProtocols parameter. The statement is incorrect in that this override authenticates using the value of the enabledSslProtocols - NOT the value SslProtocols.None.
[Enter feedback here]

Page URL

https://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslstream.authenticateasclient?view=net-8.0

Content source URL

https://github.com/dotnet/dotnet-api-docs/blob/main/xml/System.Net.Security/SslStream.xml

Document Version Independent Id

539931f5-83fa-16f5-0f22-201c5fa3cc33

Article author

@karelz

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

[ManickaP]

This is the overload https://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslstream.authenticateasclient?view=net-8.0#system-net-security-sslstream-authenticateasclient(system-string-system-security-cryptography-x509certificates-x509certificatecollection-system-security-authentication-sslprotocols-system-boolean)
It has the parameters to specify the SslProtocols so the default doesn't apply.

Also, I'd be nice to better specify the protocols and explicitly say its TLS (I know the version numbers do not overlap with SSL, but still) and probably mention TLS 1.3 is used when supported:

the allowed TLS/SSL protocols versions are 1.2, 1.1, and 1.0

the allowed TLS/SSL protocols versions are TLS 1.3 (when supported), 1.2, 1.1, and 1.0.

cc @wfurt @rzikm

[wfurt]

we should delete the extra remarks. For example, the first overload with SslClientAuthenticationOptions is applicable only to .NET Core 5+ so references to Framework are irrelevant.