An error has occurred during a tls handshake

            sslStream = new SslStream(
                _stream,
                false,
                conf.ServerCertificateValidationCallback,
                conf.ClientCertificateSelectionCallback);



            IAsyncResult result = sslStream.BeginAuthenticateAsClient(
                host,
                conf.ClientCertificates,
                conf.EnabledSslProtocols,
                conf.CheckCertificateRevocation, (IAsyncResult res) =>
                {

                }, null);

            bool inTime = result.AsyncWaitHandle.WaitOne(timeoutMs);

            if (inTime)
            {
                sslStream.EndAuthenticateAsClient(result);
                result.AsyncWaitHandle.Close();
                returnedInTime = true;
                //worked just fine
            }
            else
            {
                sslStream.Dispose();
                result.AsyncWaitHandle.Close();
                returnedInTime = false;
                //failed. cleanup. return error
            }

Installed websocket-sharp through nuget, version 1.0.3-rc11. Used to work fine, but suddenly started getting the following error:

PM|Fatal|WebSocket.connect|WebSocketSharp.WebSocketException: An error has occurred during a TLS handshake. ---> System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: The function requested is not supported
                              --- End of inner exception stack trace ---
                              at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
                              at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
                              at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
                              at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
                              at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
                              at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
                              at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
                              at WebSocketSharp.WebSocket.setClientStream()
                              --- End of inner exception stack trace ---
                              at WebSocketSharp.WebSocket.setClientStream()
                              at WebSocketSharp.WebSocket.doHandshake()
                              at WebSocketSharp.WebSocket.connect()

Any idea why this would be happening?

My code is below:

WebSocket ws = new WebSocket(url.AbsoluteUri);
ws.SetCredentials(username, password, true);
ws.OnMessage += (sender, e) => {
    ...
};
ws.OnOpen += (sender, e) =>
{
    ws.SendAsync(openingMessage, start);
};
ws.ConnectAsync();

Is TLS v1.3 enabled (for your ‘Client’) upon your machine (maybe?) — have you tried with TLS v1.2 (and even TLS v1.1) (?). Or perhaps due to a (websocket) timeout (- that can especially occur more often/easily happen when pausing for thought/analysis during debugging).

It appears that when it checks if the connection is available, and the ready-state is set to (‘WebSocketState’) ‘Closed’, it reports the error «This operation isn’t available in: closed».

It’s probably worth checking your certificates (/client certificate). Have you tried temporarily disabling the client and/or server certificate validation (?) — in case it sheds some light / gives you a clue. My money (/guess) is upon the certificates being the most likely/general cause.

Probably/generally less likely a concern, but does the cert/s match-up/comply with the enabled ciphers upon your client (/and server machine) (? — maybe someone has disabled insecure ciphers upon one of the machines).

Have you explicitly set the ‘EnabledSslProtocols’ property (- rather than it falling-back to ‘Default’ which is supposedly the old options of Tls v1.0 & Ssl3)?

Have you run both the client & server (elevated/run-)as ‘Administrator’/with Administrator rights/permissions (?).

Does your server cert contain a private key?

Knowing the specific version of ‘WebSocket-Sharp’ that you’re using could possibly prove useful to know (- ?).

As TLS (& SSL) and with certs in the mix, it can be a technical subject to deal with/predict (- I can’t say for 100% sure), but you could consider temporarily enabling more extensive logging for Windows ‘SCHANNEL’/TLS — (for the brave/careful — you should always back-up your Windows registry first before apply changes) via the Windows Registry, to see if it captures a/some future detail/s:

SCHANNEL TLS/SSL logging — 1=error, 2=warning; error & warning = 3; in the «System» log

• Bitwise OR; e.g. value of ‘7’

HKEY_LOCAL_MACHINESystemCurrentControlSetControlSecurityProvidersSCHANNELEventLogging

Value Description

0x0000 Do not log
0x0001 Log error messages
0x0002 Log warnings
0x0004 Log informational and success events

The Internet has made it convenient for us to find any information we need. You can visit websites directly or use a search engine like Google to access various types of data. However, there are times when we are not able to open web pages, and there could be several reasons behind this. In some cases, it may have something to do with your network connection. On the other hand, another common issue that causes this problem is a TLS handshake failure.

Now, you might ask, “What does a TLS handshake mean?” TLS stands for Transport Layer Security, which is an encryption protocol. Communications made via this protocol remain private and secure. In this post, we are going to explain what happens in a TLS handshake. In this way, you will gain a better grasp of the concept. Moreover, we will teach you how to fix the TLS handshake failed error.

What Does a TLS Handshake Mean?

As we all know, when there is a form of negotiation or greeting between two people, we seal it with a handshake. Similarly, when two servers communicate and acknowledge each other, they form a TLS handshake. During this process, the servers go through verification. They establish encryption while exchanging keys. Once all the details have been proven to be authentic, the data exchange will begin. Here are the four steps involved in a TLS handshake:

1. Indicating the TLS version which will be used for communication.
2. Selecting the encryption algorithm for communication.
3. A public key and the digital signature of the SSL certificate issuer will be used to verify authenticity.
4. Session keys will be generated, which will then be exchanged between the two servers.

To make things simple, both parties will say ‘hello’ first. Then, the server will provide a certificate, which the client will verify. Once the certificate has been proven to be authentic, the session will begin. Before that, a key will be created, which will allow the data exchange between the servers.

How to Fix TLS Handshake Issues

Unfortunately, if the problem stems from the server, there is nothing you can do. For instance, if the certificate from the server cannot be authenticated, then the matter is out of your hands. However, if you are having issues with the browser you’re using, then there are still plenty of workarounds you can try. Also, if you’re dealing with a mismatch in the TLS protocol, you can fix the problem from the browser.

Various reasons could be behind a TLS handshake failure. Before you try to fix the problem, you should ensure that you’re definitely dealing with a TLS handshake error. In most cases, you can follow these rules:

1. Try visiting other sites and see if the problem persists.
2. If you’re using a WiFi network, try switching to a wired one.
3. Try other network connections. For instance, use a different router or switch to a public network.

Once you’ve established the cause of the problem, you might ask, “Should I disable a TLS handshake on my browser?” We understand your frustration, but we do not recommend doing it. After all, the TLS protocol is one of the best ways to ensure a secure browsing experience. Indeed, you can continue browsing a website even with an invalid certificate. However, you should never perform any form of transaction with it. For example, do not submit password credentials or use your credit card.

On the other hand, there are times when the TLS handshake failure stems from issues with your browser. In this case, you can fix the problem by reconfiguring some settings on your browser. We’ll share some of the best workarounds below.

Solution 1: Ensuring the Correct System Time

Most of the time, a TLS handshake fails because of incorrect system time settings. Keep in mind that the system time is a vital factor in testing whether a certificate is still valid or expired. So, if the time on your PC does not match the server’s, then it will seem like the certificates are no longer valid. So, we recommend that you set the system time to ‘automatic’. Here are the steps:

1. On your keyboard, press Windows Key+I. Doing so will open the Settings app.
2. Once you’re on the Settings app, select Time & Language.
3. Go to the right pane, then toggle the switch under Set Time Automatically to On.
4. Restart your computer, then try visiting the site again to see if the TLS handshake error is gone.

Solution 2: Changing the TLS Protocol in Windows 10

Perhaps, the issue has something to do with the TLS version that your browser is using. It is worth noting that Windows 10 and earlier versions of the operating system centralize the protocol settings. You can access Internet Properties to switch to a different TLS version. To do that, follow these instructions:

1. Launch the Run dialog box by pressing Windows Key+R on your keyboard.
2. Inside the Run dialog box, type “inetcpl.cpl” (no quotes), then click OK.
3. On the Internet Properties window, go to the Advanced tab.
4. Scroll down until you get to the Security section, where you can add or remove TLS protocols.
5. If the website you’re trying to access needs TLS 1.2, then you need to select it.
6. Click Apply and OK to save the changes you’ve made.
7. After changing the TLS version, try accessing the same website again.

When it comes to TLS protocols, IE, Chrome, and Edge take advantage of Windows features. Meanwhile, Firefox manages its own certificate database and TLS protocols. So, if you want to change the TLS version on Firefox, use the following steps:

1. Launch Firefox, then type “about:config” (no quotes) in the address bar.
2. Press Enter, then click the search box.
3. Type “TLS” (no quotes), then look for security.tls.version.min.
4. You can modify that into any of the following:

Force TLS 1 and 1.1 by entering 1 and 2.

Force TLS 1.2 by entering 3.

Force a maximum protocol of TLS 1.3 by entering 4.

Solution 3: Deleting the Certificate Database or Browser Profile

Browsers keep a certificate database. For instance, Firefox profiles maintain a cert8.db file. There is one way to know that the TLS handshake failure is related to the local certificate database. You can try deleting the cert8.db file on Firefox. If the error disappears when you restart your computer and browser, then you’ve determined the culprit.

For Edge, the Certificate Manager is responsible for handling the certificates. You can delete the certificates by following these steps:

1. Open Edge, then enter “edge://settings/privacy” (no quotes) in the address bar.
2. Click the ‘Manage HTTPS/SSL certificates and settings’ option, then delete the certificates.

If you’re having trouble finding the certificate database, your best bet is to delete the browser profile. Once you’ve done this, you can try accessing the website again to see if the TLS error is gone.

Solution 4: Resetting Your Browser

If none of the fixes we shared is able to resolve the TLS problem, then your last resort is to reset your browser. The best way to do this is to uninstall and reinstall your browser. Once you’ve done this, you can try accessing the website again to check if the TLS error is gone.

Which of the solutions helped you fix the TLS handshake issue?

Let us know in the comments below!

Secure Sockets Layer (SSL): It is an internet security protocol based on encryption. It was developed in the year 1996 by Netscape to ensure privacy, authentication, and data integrity. It is the predecessor to TLS encryption. It provides a secure channel between two devices or machines communicating over the Internet or even an internal network. SSL is also used to secure communication between web browsers and web servers. This can be seen when a site’s address has HTTPS, where the ‘S’ stands for ‘secure’. It is also a transparent protocol and requires little to no interaction from the end user in establishing a secure session. Some examples of services protected by SSL are online payments, webmail servers, and system logins.

Transport Layer Security (TLS): It can be described as a more secure and updated version of SSL. It is a cryptographic protocol that allows end-to-end security of data exchanged between different applications over the Internet. It was specifically based on SSL 3.0 and was developed in the year 1999 by the Internet Engineering Task Force (IETF). As SSL has not been updated since the year 1996, TLS has been considered the industry standard for over 20 years. TLS is implemented on top of TCP to encrypt Application Layer protocols like HTTP, FTP, SMTP, and IMAP. It can also be implemented on UDP, DCCP, and SCTP. The main use of TLS is to encrypt the communication between web applications and servers. For example, web browsers loading a website.

An SSL/ TLS handshake error occurs when the client and server can’t establish communication over the SSL/TLS protocol (usually due to a protocol mismatch). 

Some common fixes to the SSL/TLS handshake failed error:

1. Correcting System Time: It is one of the easiest and most obvious fixes. If the system date and time on your device are incorrect, it can cause an SSL/TLS handshake failed error. This error happens because the correct date and time are essential for SSL certificates; as they have finite lifespans and have an expiration date.

2. Using a different Browser: Sometimes, the browser in use can cause the SSL/TLS handshake failure. It may be due to a browser misconfiguration or a browser plugin, which can cause problems in connecting to legitimate websites. As finding out the exact misconfiguration can be time-consuming, you can simply try another browser. If you still face the SSL/TLS handshake failure even after changing the browser, the issue usually lies with the browser plugins. To verify whether this is the case, disable all installed plugins and check again.

3. Add website to allowlist: It may be possible that your firewall is intercepting your request for inspection, causing an SSL/TLS handshake failure. To fix this, add the website to your allowlist. For Google Chrome,

• Open the admin console homepage and go to Devices→Chrome.
• Settings→Users & browsers.
• Leave the top organizational unit selected (which it should be by default). This applies the setting to all users and enrolled browsers.
• Scroll down to URL Blocking and enter the website you want to access, under Blocked URL Exceptions.
• Hit Save.

4. Update browser to the latest SSL protocol: To check if your browser is using the latest SSL protocol:

• Visit SSL Labs. 
• Click on Projects.
• Click on SSL Client Test.
• Under Protocol Support, check whether your browser supports the latest version of TLS.

Advantages of SSL/TLS:

• Improved Security.
• Easily deployed.
• Ability to use HTTP/2.

Disadvantages of SSL/TLS:

• Speed degradation.
• Allows insecure encryption.
• Plugin incompatibility.