Could not create SSL/TLS secure channel on https://i.etsystatic.com/...jpg

[davidpierson]

This issue is occurring on the open Etsy site, not the V3 api. If there is somewhere else I should post this, please let me know.

Trying to download files (jpegs) from https://i.etsystatic.com is failing with Could not create SSL/TLS secure channel since the last few weeks. This occurs in my ASP.Net C# website when the code uses this to fetch an image ...

WebClient web = new WebClient();
web.DownloadFile(imageUrl, fn);

The imageUrl is from calling the /listings?state=active&includes=Images endpoint. The image URL itself is fine and works in browsers.

I am also following this up with my webhost as the error only occurs there. No problem from my own local PC.

This looks like something to do with TLS versions and Cipher Suites.
Fetching an image in Chrome in F12 in the security tab it shows:
The connection to this site is encrypted and authenticated using TLS 1.3, X25519, and AES_256_GCM.
Note the TLS 1.3 in that message.
However when I set ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls13;
it fails both on my local PC and in the webserver.
Only TLS 1.2 works.
Which does not align with the Chrome Security tab showing a TL1.3 c,onnection.

i.etsystatic.com is an Akamai CDN endpoint, quite separate to the Etsy API endpoint, where I'm not seeing any issues.

Has anyone else encountered somethign similar?

[davidpierson]

Figured out the cause. Our server (which is the client in the TLS here) is running Server2012R2 which just went end-of-support. Akamai removed the equivalent now-out-of-support TLS 1.2 Cipher Suites from their server. They still have cover for in-support operating systems.

Also found that the cipher suites supported by browsers, and curl, is not the same as the list that is supported by the Windows o/s Schannel, which .Net Framework uses. That was why browsers still worked on the machine.