SSL Handshake problem in .NET but not curl (same machine)

[dave-yotta]

Minimal repro on plain mcr.microsoft.com/dotnet/sdk:8.0 image.

handshake aborted.zip

From what I can tell, the remote client here at itouch.vision is failing the handshake immediately after being told the supported protocol versions?

12:30:23.5635743[Private.InternalDiagnostics.System.Net.Security.SentFrame] sslStream: SslStream#5896758, tlsFrame: Tls:ClientHello[290] TargetName='itouch.vision' SupportedVersion='Tls, Tls11, Tls12, Tls13' ApplicationProtocols='None', isComplete: 1
12:30:23.5836356[Private.InternalDiagnostics.System.Net.Security.ErrorMessage] thisOrContextObject: SslStream#5896758, memberName: ReceiveHandshakeFrameAsync, message: Received TLS alert HandshakeFailure

I don't understand why the same doesn't happen with curl on this same container?

* Connected to itouch.vision (185.144.220.110) port 443 (#0)
* ALPN: offers h2,http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [85 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [2761 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [262 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / AES256-GCM-SHA384
* ALPN: server did not agree on a protocol. Uses default.

[dave-yotta]

Ah - I've had a look in wireshark - the server didnt want to use any of the available cyphers. Curl overrides the openssl defaults while .net does not https://learn.microsoft.com/en-us/dotnet/core/compatibility/cryptography/5.0/default-cipher-suites-for-tls-on-linux.