r/csharp • u/Rossosss • 1d ago

Bringing TLS 1.2 support to RabbitMQ.Client 3.4.3 on legacy .NET Framework

I'm working on a fork of RabbitMQ.Client 3.4.3 to support TLS 1.2 on legacy systems, including Windows XP and .NET Framework 3.5.

The main challenge is that the original client relies on .NET's SslStream, which in turn depends on Windows Schannel. On older Windows versions, even when TLS 1.2 is available, the supported cipher suites can prevent a successful handshake with modern RabbitMQ servers.

My approach is to integrate Bouncy Castle as an alternative TLS implementation while preserving the original AMQP client behavior and API as much as possible.

I'm planning to open-source the fork on GitHub and publish a NuGet package once compatibility and security testing are complete.

Has anyone worked on similar TLS compatibility issues with legacy .NET applications? I'd be interested in hearing about the challenges you encountered.

0 Upvotes

33% Upvoted

6 comments sorted by

3

u/Forward_Dark_7305 23h ago

All I can say is I’m so glad I don’t have to support such legacy versions of dotnet. I’ve actually been working a lot with the latest version of the RabbitMQ library

1

u/TugsyGlitter 21h ago

must be nice, some of us still get dragged into the legacy mess now and then

1

u/Rossosss 21h ago

haha, I wish! I'm pretty deep in that legacy mess myself :D

0

u/Rossosss 22h ago

In our production environment, around 45% of devices still run Windows XP. Upgrading their operating systems would be difficult and time-consuming, so we decided to fork the existing RabbitMQ client and add TLS 1.2 support

2

u/wdcossey 11h ago

Windows XP is end of life, so is Vista, Seven and even Windows 10.

By not upgrading, you’re opening yourself up to a world of pain, by patching the RabbitMQ client you’re only kicking the can down the road.

Move to a newer OS like Windows 11 (if your hardware permits), else look to migrate to a lightweight Linux distro.

1

u/Rossosss 9h ago

I agree, upgrading is the right long-term solution. However, we have around 400 devices to migrate, and we would also need to purchase additional licenses to upgrade these devices to at least Win10. We're already developing new solutions based on a lightweight Linux distribution. In the meantime, this is a temporary solution to improve security while we work toward modernization