How to fix "the server certificate is not configured properly with HTTP.SYS" on Windows 7?

Question

I'm building a wcf client which consumes a service from a brazilian government institution. This connection uses Soap 1.2 and it needs to be signed with a digital certificate.

The code used for this example is a Console Application using .Net 4.6.1. The main application is a WPF application (I'm not using IIS). This code works without a problem on Windows 10 but when I try to run it on Windows 7 it gives me the following error:

System.ServiceModel.CommunicationException: An error occurred while making the HTTP request to https://nfce-homologacao.svrs.rs.gov.br/ws/NfeStatusServico/NfeStatusServico2.asmx. This could be due to the fact that the server certificate is not configured properly with HTTP.SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server. ---> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host.

This is the client call code:

XmlNode node = null;

var parametro = new TConsStatServ();
parametro.cUF = NFeAPI.XMLSchemas.NfeStatusServico2.Envio.TCodUfIBGE.Item53;
parametro.tpAmb = NFeAPI.XMLSchemas.NfeStatusServico2.Envio.TAmb.Item2;
parametro.versao = "3.10";
parametro.xServ = TConsStatServXServ.STATUS;

var certificate = GetCertificateByName("Certificate Name", false);

string nFeNamespaceName = "http://www.portalfiscal.inf.br/nfe";
string parametroXML = XmlUtil.Serialize(parametro, nFeNamespaceName);

XmlDocument doc = new XmlDocument();
XmlReader reader = XmlReader.Create(new StringReader(parametroXML));
reader.MoveToContent();

node = doc.ReadNode(reader);

nfeCabecMsg soapHeader = new nfeCabecMsg();
soapHeader.cUF = parametro.cUF.ToString().Replace("Item", "");
soapHeader.versaoDados = "3.10";

var soapClient = new NfeStatusServico2SoapClient("NfeStatusServico2Soap");
soapClient.ClientCredentials.ClientCertificate.Certificate = certificate;

XmlNode result = soapClient.nfeStatusServicoNF2(ref soapHeader, node);

Here is my App.config:

<system.serviceModel>
    <bindings>
        <basicHttpBinding>
            <binding name="NfeStatusServico2Soap">
              <security mode="Transport">
                <transport clientCredentialType="Certificate"/>
              </security>
            </binding>
            <binding name="NfeStatusServico2Soap1" />
        </basicHttpBinding>
    </bindings>
    <client>
        <endpoint address="https://nfce-homologacao.svrs.rs.gov.br/ws/NfeStatusServico/NfeStatusServico2.asmx"
            binding="basicHttpBinding" bindingConfiguration="NfeStatusServico2Soap"
            contract="NfeStatusServico2.NfeStatusServico2Soap" name="NfeStatusServico2Soap" />
    </client>
</system.serviceModel>

The GetCertificateByName is helper method I've created to return the X509Certificate2 need by the service.

I've already tried disabling Windows 7 firewall and I went to Programs and Features -> Turn Windows features on or off and enabled the .net 3 framework node for wcf calls.

I have also tried to use a WebReference with a .NET 2.0 application and it gave the same error. I upgraded the code to use wcf in .net 4.6.1 in hope for it to work.

I tried to use fiddler to track the problem and it returns the code 200 but not much help with that.

It's been 5 days and I can't manage to get around this issue. I'm about to drop Windows 7 support on my application because of that.

Solution

In my case, the problem was that my project was still using .Net Framework 4.0, which does not support TLS 1.1 or 1.2, and the service I was connecting to had turned off support for TLS 1.0 as of Jan 1, 2018. Once I upgraded the project to .Net Framework 4.5 and forced TLS 1.2, everything worked fine.

System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12;