Event ID 36887 TLS致命警报40：生产环境连接Equifax失败求助

Alright, let's tackle this TLS handshake failure (alert code 40 = handshake_failure) with Equifax—you've already done a solid set of initial checks, so let's dig into the more nuanced angles that might be causing the discrepancy between your production and preproduction environments.

Core Context Recap #

First, to align on the basics: You're seeing Event ID 36887 on Windows Server 2012 R2 (.NET 4.6.2) when connecting to Equifax's TLS 1.2-enabled URL. Preprod works fine, prod doesn't—even though TLS registry settings, .NET versions, and web.config are identical, and both use the same Equifax URL (different credentials). Your site uses HTTP via Citrix Netscaler, but outbound traffic to Equifax is HTTPS.

Targeted Troubleshooting Steps #

1. Deep Dive into Cipher Suite Differences #

TLS alert 40 often stems from mismatched cipher suites between client (your prod server) and server (Equifax). Even if TLS protocols are enabled, cipher suite order or availability can break the handshake:

• Run Get-TlsCipherSuite in PowerShell on both prod and preprod, then compare the full list and their priority order. Equifax may only support a narrow set of suites, and prod's order might not prioritize a compatible one.
• Check if domain group policy is overriding local cipher suite settings on prod—this is easy to miss, especially if prod is in a stricter OU. Use gpresult /h gpreport.html to audit applied policies related to SSL/TLS.

2. Verify Certificate Trust Chain Completeness #

Even though your site uses HTTP, outbound HTTPS to Equifax requires your prod server to trust Equifax's root/ intermediate certificates:

• Open certmgr.msc on both environments, navigate to Trusted Root Certification Authorities and Intermediate Certification Authorities, then compare Equifax-related certificates. Prod might be missing an intermediate CA cert that preprod has.
• For a quick test, use openssl s_client -connect [equifax-url]:443 (if you have OpenSSL installed on prod) to check if the certificate chain returns "verify return code: 0 (ok)". A non-zero code points to a trust issue.

3. Rule Out Network Layer Interference (Netscaler/Firewalls) #

Your prod environment's outbound traffic might be modified by Netscaler or a firewall in a way preprod isn't:

• Bypass Netscaler temporarily: Edit the hosts file on prod to map Equifax's URL directly to its public IP, then test the connection. If it works, the issue is with Netscaler's outbound SSL settings (e.g., SSL inspection enabled, cipher suite restrictions, or protocol stripping).
• Check if prod's firewall has any outbound HTTPS filtering that blocks specific TLS extensions or cipher suites used by Equifax.

4. Validate .NET Framework's Strong Crypto Settings #

While .NET 4.6.2 should support TLS 1.2 by default, incorrect registry settings can force it to use older protocols:

• Confirm both of these registry keys are set to 1 on prod (check 32-bit and 64-bit paths):
  • HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SchUseStrongCrypto
  • HKLM\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319\SchUseStrongCrypto
• These keys ensure .NET uses modern TLS protocols instead of falling back to older, insecure ones.

5. Focused Packet Capture Analysis #

When you run a Wireshark capture on prod, zero in on these TLS handshake stages:

• Client Hello: Verify prod is sending TLS 1.2 as the highest protocol version, and that the cipher suite list includes ones Equifax supports (cross-reference with preprod's Client Hello).
• Server Response: If Equifax sends an immediate handshake_failure alert, it means none of prod's proposed cipher suites or protocols are accepted. If a Server Hello is sent, check if the certificate is rejected (look for "Certificate Verify" failures) or if key exchange fails.
• Compare prod's capture directly with preprod's—this will almost always reveal the exact mismatch.

6. Test with Forced Cipher Suites #

As a temporary diagnostic step, force prod to use the exact cipher suites that work in preprod:

• In IIS, go to your site's SSL Settings > Advanced > Cipher Suites, and add the top 3-5 cipher suites from preprod's Get-TlsCipherSuite output to the top of prod's list.
• Restart the site and test the connection—if it works, you've confirmed the issue is cipher suite prioritization.

内容的提问来源于stack exchange，提问作者Chris Wright