Error: "TLS handshake error: tls: no cipher suite supported by both client and server" when NATS hosted on Windows Server 2012 R2 - nats.io

Question

I am using NATS messaging server on Windows Server 2012 R2. I have provided the TLS configuration as follows:
authorization {
user: administrator
password: $2a$10$9cVa4WHttwTQDpOnpGP1HuWi44WXTrYvrUO6uWkNlpLPeBFFOnpr6
timeout: 500
}
tls {
cert_file: "C:/NATS/CertFile.pem"
key_file: "C:/NATS/KeyFile.pem"
timeout: 2
}
I am using BCrypt to store password and X509 self-signed certificate. When I run the server on Windows Server 2016, the clients connects successfully while using secure communication. But when I use the NATS server on Windows Server 2012 R2, it give me the an exception in my client application.
Can you please help me out?
Many thanks,
Adeel.
I have tried updating to NATS.Client to v0.9.0.
I set the following property in C# while using NATS.Client API:
NATSConnectionSetting connectionSetting = NATSConnectionSetting.GetDefaultNATSConnectionSetting();
connectionSetting.UseTLS = true;
The exception I am getting in client application logs:
NATS.Client.NATSConnectionException: TLS Authentication error ---> System.AggregateException: One or more errors occurred. ---> System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: The message received was unexpected or badly formatted
In the NATS server logs I can see:
TLS handshake error: tls: no cipher suite supported by both client and server

Answer 1

Some windows systems can be restrictive as to what cipher suites they support. NATS defaults to only the most secure cipher suites, but does allow for specification of others in the configuration.
Here is a TLS configuration stanza that specifies cipher suites that should work on most windows systems:
tls {
cert_file: "C:/NATS/CertFile.pem"
key_file: "C:/NATS/KeyFile.pem"
cipher_suites: [
"TLS_RSA_WITH_RC4_128_SHA",
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_RSA_WITH_RC4_128_SHA",
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
]
}
Another reference can be found in the testing configuration, here. I suggest narrowing the cipher suites down to include only the most secure suites that work in your environment and to avoid RSA if you can. To get a list of all available cipher suites, run nats-server -help_tls. Hope this helps!