Could not create SSL/TLS secure channel - Help!

[mdrapps]

Many thanks in advance! Need help understanding what changed or what I need to do. On the morning of 5/5/25 my c# application that uses HttpWebRequest/HttpWebResponse to call "https://forecast.weather.gov/MapClick.php?lat=43.21&lon=-77.42&FcstType=dwml" was working fine. In the afternoon it started throwing the error "Could not create SSL/TLS secure channel." Did something on the weather.gov server side change? new security? anyone info on the change?

[scadergit]

Hi, @mdrapps, the development team doesn't have full insight into operational changes. If this is still an issue, please contact OMB as noted in the welcome discussion sticky: #200

[mdrapps]

"The public certificate was updated at around 10 ET this morning (5/5/25)".... That statement coincides perfectly when then problem started. However — I got it working on Windows 11, but not Server 2012 R2, Server 2016. It seems like the cipher used in the new certificate isn't the same as before and not compatible with many previous operating systems.

I realize this is highly technical, but if the new certificate can use the previous TLS Cipher than all would be fixed. If that is not possible, then the certificate provider should explain what Cipher is required to have installed.

[dwhitemv25]

Windows Server 2012 R2 went out of support in October 2023. ECDSA certificates are supported in Windows Server 2016/Windows Vista and later natively. If you are having issues with 2016, make sure you are using the most up-to-date root certificate update.

[mdrapps]

They just changed the Cipher back to the original one, all is working now. It's still using TSL 1.2 which is great for security.

[dwhitemv25]

Looks like you're right, api.weather.gov has an RSA cert now, it was ECDSA yesterday.

A minimum TLS 1.2 is mandated by government policy.

[JoePerkinsSeneGence]

weather.gov.crt.txt

I'm seeing a Let's Encrypt cert for that endpoint from my location, another cert might be issued from other edge servers. However, I do not see any edge server headers in the response.

[jah1007]

Just closing out here. While the cipher update was rolled back, we will be eventually implementing the ciphers that were in place at a later date. A SCN will be issued and will be available at our API documentation page weather.gov/documentation.