3 ms·
Nor do they like updating schannel.dll (the underling SSL/TLS stack) unless there's an extremely serious vulnerability in it. And even then, they bungle it more
by prdonahue 11y ago
Nor do they like updating schannel.dll (the underling SSL/TLS stack) unless there's an extremely serious vulnerability in it. And even then, they bungle it more often than not (http://www.infoworld.com/article/2848574/operating-systems/microsoft-botches-kb-2992611-schannel-patch-tls-alert-code-40-slow-sql-server-block-iis-sites.html http://www.infoworld.com/article/2848574/operating-systems/m...).
The reason SChannel matters is that the protocol used to negotiate which "next generation" protocol is to be used for the HTTP connection (not session, minor point) is something called Application-Layer Protocol Negotiation. ALPN is a TLS extension sent as part of the ClientHello but wasn't added to SChannel until Windows 8.1/2012 R2 Server. (There was a predecessor to ALPN called NPN that Adam Langley authored/implemented for Chrome but Microsoft never implemented it.)