How do I force VB.Net (2010) to use TLS as required by PayPal changes?

We need to update our app (running on WinXP) to successfully post transactions to PayFlowPro which is disabling SSL 3.0 on 12/3.  We are using MSXML2.XMLHTTP in vb.net to post the transactions like this:
       
        Dim xmlHTTP As MSXML2.XMLHTTP = New MSXML2.XMLHTTP
        xmlHTTP.open("POST", strURL, False)
        xmlHTTP.setRequestHeader("Content-Type", "application/x-www-form-urlencoded")
        System.Windows.Forms.Application.DoEvents()
        xmlHTTP.send(snd)
        resp = xmlHTTP.responseText

I tried putting the following above the dim statement:
       'System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls
but it didn't change anything.  Anyone have any idea how to accomplish this?
DalexanAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

GaryCommented:
There is no reason your pc would be using SSL unless you specifically tell it to or you don't have TLS installed (which is highly unlikely)
0
GaryCommented:
...assuming you have SP3 installed
0
DalexanAuthor Commented:
We do have SP3 installed.  Their server site, https://payflowpro.paypal.com, works fine, but their test site that has been set up to not allow SSL3.0, https://developer.paypal.com/docs/classic/lifecycle/ug_sandbox, fails.  I/m not sure what else it would be.
0
Introducing the "443 Security Simplified" Podcast

This new podcast puts you inside the minds of leading white-hat hackers and security researchers. Hosts Marc Laliberte and Corey Nachreiner turn complex security concepts into easily understood and actionable insights on the latest cyber security headlines and trends.

GaryCommented:
You have this
'System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls

but it's commented out, is that a typo?
0
DalexanAuthor Commented:
No, I tried that but it didn't help so I commented it back out...I did forget to mention, the execution gets through the open call, but fails on the POST call with "Error 53 - System error -2146697208"...no other system or application log entries.
0
käµfm³d 👽Commented:
Not that there's much difference in the end result, but why are you using MSXML2.XMLHTTP and not something like WebClient or HttpWebRequest, which are already a part of the Framework? Why the COM?

I agree with Gary that the commented-out line should be what you need. I was just playing around with this the other day, and changing that line altered which SSL suite was in play.
0
DalexanAuthor Commented:
This is code we have had in place for quite some time, so, as long as it works we've avoided making any changes.  Would the position of the SecurityProtocol assignment make a difference?  I had it in the code above the Dim xmlHTTP statement...
0
GaryCommented:
Try it with

System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12

What version of .net are you using?
0
DalexanAuthor Commented:
The autocomplete only shows Ssl3 and Tls...no Tls12 option. .NET Framework 4 is the target framework in the app Compile tab.
0
käµfm³d 👽Commented:
Now that I think about it, that setting may not have any impact on MSXML2.XMLHTTP. That's a small block of code; can we try replacing it with the following?

Using client As New System.Net.WebClient()
    System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls
    client.Headers("Content-Type") = "application/x-www-form-urlencoded"
    System.Windows.Forms.Application.DoEvents()
    resp = client.UploadString(snd)
End Using

Open in new window

0
DalexanAuthor Commented:
Well, that got me a little further, I think...I got "5 - The remote server returned an error: (500) Internal Server Error"
0
DalexanAuthor Commented:
btw, I had to add strurl as the first parameter to the UploadString...
0
käµfm³d 👽Commented:
Is the value in strURL your server or PayPal?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
DalexanAuthor Commented:
0
käµfm³d 👽Commented:
As far as I can tell, the above is what you need. The only other thing I can suggest would be to use a tool like Fiddler and examine the request that's going out to ensure it is formatted correctly. 500s usually indicate a problem on the server, not the client. You may have to contact PayPal to find out why they are returning 500s in certain scenarios.
0
DalexanAuthor Commented:
After speaking with Paypal support there was an issue with our account setup and this feature was not activated or partially activated on our account which was throwing error conditions.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Development

From novice to tech pro — start learning today.