Nugetgallery: "Could not create SSL/TLS secure channel" error in Visual Studio

[loic-sharma]

Describe the bug

Some Visual Studio customers are reporting the following error:

Unable to load the service index for source https://api.nuget.org/v3/index.json.
An error occurred while sending the request.
The request was aborted: Could not create SSL/TLS secure channel.

The NuGet team is actively investigating this problem. At this time, the issue's root cause is unknown. See: https://developercommunity.visualstudio.com/content/problem/815971/unable-to-browse-nuget-packages-1.html

Workaround

Some customers have reported that disabling TLS 1.3 has resolved their issues:

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server' -name 'Enabled' -value '0' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client' -name 'Enabled' -value '0' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null
Write-Host 'TLS 1.3 has been disabled.'

You may also need to change your .NET Framework default TLS version:

reg add HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 /v SystemDefaultTlsVersions /t REG_DWORD /d 1 /f /reg:64
reg add HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 /v SystemDefaultTlsVersions /t REG_DWORD /d 1 /f /reg:32

[niranjankala]

The fix is working for me. executing these commands made the NuGet working again in Visual Studio.

[dannyjdev]

I was able to create a VM on Azure that reproduce the problem, these are the things that I learned/noticed.

I started with the 1903 Windows version on the VM and upgrade it to Windows 1909 which seems to be the one that has the issue. The workaround here mentions that we need to set Enabled to 0and DisabledByDefaultto 1, something interesting is that after I updated
the Windows version I couldn't see any of those registries (HKLM:...\Protocols\TLS 1.3\Server or HKLM:...\Protocols\TLS 1.3\Client) on the VM and everything worked fine.

After that I created those registries manually using the opposite values Enabled to 1 and DisabledByDefault to 0 for each registry and when I tried to perform a search on the VS package manager I could reproduce the error everyone is getting.

I downloaded 3 different versions of Visual Studio (Community 2019 16.3.9, Community 2019 Preview 16.4.0 Preview 5.0, and Professional 2019 Preview 16.4.0 Preview 5.0) everyone facing the same issue for invalid registries. This issue can be seen on NuGet PM UI and VS Extensions.

As the workaround above mentions, disabling TLS 1.3 resolved the issue.

[dannyjdev]

We think that we have already fixed the issue on our side, in case someone else is having the same problem please reach out to our support email ([email protected]) or create an issue on our GitHub repository (https://github.com/NuGet/NuGetGallery/issues), our team should be able to provide help.

[vatsan-madhavan]

@dannyjdev @rladuca and I have hit this issue a couple of times in the last week, and we just heard a report from one of our testers that they hit the issue too. The workaround is has been effective (great!), but is there a programmatic safeguard/prevention that we can put in that would sidestep the problem from happening in the first place?

[bmomartins]

Worked for me, thanks!
Issue encountered when using Install-GraphViz cmdlet.

[stevenlupo]

If this does not work, you have to make sure you have the TLS 1.2 registry keys present. To add them, see this.

This was the problem I had. It won't default to TLS 1.2 even if you tell it not to use TLS 1.3.

[hieunm22]

I still have problem when running dotnet build to build my app
I'm using Ubuntu 18.04 LTS, how to fix it?
thanks

[E66666666]

This issue seems to have arised again. In November 2020, I was able to publish a self-contained, single-file C# application (using the then-latest available VS2019) without issues. Today I ran into this issue (VS2019 16.8.6) trying to publish it again, using the same settings.

Windows 10 1809 (Company laptop)
Visual Studio 2019 16.8.6

Running the workaround commands fixed the issue for me, but still odd it stopped working randomly.