← Knowledge base

.NET

SslStream and HttpClient depend on platform TLS support. Windows, Linux, and Apple platforms do not share one universal OpenSSL configuration.

Evidence to collect

  1. Record the deployed .NET runtime and operating system.
  2. Review the platform-specific TLS backend and supported options. Installing OpenSSL on macOS does not establish that .NET uses it.
  3. Check Kestrel ingress, reverse proxies, outbound HTTP, and database connections separately.
  4. CipherSuitesPolicy and TLS 1.3 support are not proof of a post-quantum selected group.

Read-only inventory

Run this in the environment used by the application. Missing commands mean the tool is unavailable. This output is inventory, not a negotiation result.

dotnet --list-runtimes

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.