TRestClient, TLS 1.2, & Windows Server 2012 R2

[Kyle Miller 1]

Given a site requires TLS 1.2 or higher and Delphi 12 Version 29.0.50491.5718, I have an app which cannot communicate with the server when run on Windows Server 2012 R2. It works fine on Windows 10.

 

If TRestClient is configured with no SecureProtocols selected (default), the app has this error:

ERESTException: REST request failed: Error sending data: (12175) A security error occurred

 

If TRestClient is configured with TLS 1.2 and TLS 1.3 SecureProtocols selected, the app has this error:

ERESTException: REST request failed: Error sending data: (590615) The context has expired and can no longer be used

I'm assuming, with no SecureProtocols, it's attempting TLS 1.1 and failing. If so, understandable.

 

I configured Server 2012 R2 to use TLS 1.2 according to the following instructions & many others. I tried allowing TLS 1.1 and 1.2 and am now configured for TLS 1.2 only.

https://woshub.com/enable-tls-1-2-windows/

 

How to resolve this issue?

Edited August 2 by Kyle Miller

[Angus Robertson 574]

I used to support a Windows 2012 R2 (Windows 7) server, and keeping SChannel SSL running was a pain, since TLS/1.2 was never part of the original OS and had been added with patches. 

 

The main problem was it kept forgetting SChannel TLS/1.2 ciphers, usually after each reboot.  Before rebooting, I always used the IISCrypto tool from https://www.nartac.com/ to select all the required ciphers, specifically ECDHE ciphers since I use EC key certificates which Microsoft does not like. 

 

Servers using OpenSSL worked fine of course. 

 

Angus