title: ASP.NET Core 3.0 app not working on Windows Server 2012 R2 due to ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY
body: <p>I took a working ASP.NET Core 2.2 app, upgraded it to 3.0 and suddenly the app no longer works in Windows Server 2012. It comes up with the following:</p>
  
  <p><code>ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY</code></p>
  
  <p>Chrome:
  <a href="https://i.stack.imgur.com/xshJ0.png" rel="noreferrer"><img src="https://i.stack.imgur.com/xshJ0.png" alt="enter image description here"></a></p>
  
  <p>Firefox:
  <a href="https://i.stack.imgur.com/bOb9H.png" rel="noreferrer"><img src="https://i.stack.imgur.com/bOb9H.png" alt="enter image description here"></a></p>
  
  <p>It seems that before I had to opt into HTTP/2 and now its the default along with HTTP1.1. There is a post here <code>https://github.com/aspnet/AspNetCore/issues/14350</code> but that is totally confusing with no real solution.</p>
  
  <p>I have tried all sorts of enabling / disabling insecure protocols but to no avail. Such as <a href="https://www.admin-enclave.com/de/articles-by-year/11-data-articles/website_articles/articles/exchange_articles/405-resolved-error-err_spdy_inadequate_transport_security-when-using-google-chome-and-owa.html" rel="noreferrer">https://www.admin-enclave.com/de/articles-by-year/11-data-articles/website_articles/articles/exchange_articles/405-resolved-error-err_spdy_inadequate_transport_security-when-using-google-chome-and-owa.html</a></p>
  
  <p>Works fine on Windows 10 due to what I assume more better protocol suite. But in Fiddler I checked and the only difference when negotiating with Kestrel is:</p>
  
  <p>Windows Server 2012 R2:</p>
  
  <pre><code>[0A0A]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [1301]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [1302]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [1303]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [C02B]  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  [C02F]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [C02C]  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  [C030]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [CCA9]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [CCA8]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [C013]  TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
  [C014]  TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
  [009C]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [009D]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [002F]  TLS_RSA_AES_128_SHA
  [0035]  TLS_RSA_AES_256_SHA
  [000A]  SSL_RSA_WITH_3DES_EDE_SHA
  </code></pre>
  
  <p>Windows 10:</p>
  
  <pre><code>[3A3A]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [1301]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [1302]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [1303]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [C02B]  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  [C02F]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [C02C]  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  [C030]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [CCA9]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [CCA8]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [C013]  TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
  [C014]  TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
  [009C]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [009D]  Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
  [002F]  TLS_RSA_AES_128_SHA
  [0035]  TLS_RSA_AES_256_SHA
  [000A]  SSL_RSA_WITH_3DES_EDE_SHA
  </code></pre>
  
  <p>The top line is different, but that is all. Not sure what is it, it is some <code>GREASE</code> value.</p>
  
  <p>Program.cs:</p>
  
  <pre><code>    public static IWebHostBuilder CreateWebHostBuilder(string[] args) =&gt;
        WebHost.CreateDefaultBuilder(args)
        .UseKestrel(opts =&gt; {
          opts.ListenAnyIP(5000);
          opts.ListenAnyIP(5001, listenOpts =&gt; {
            listenOpts.UseHttps(new HttpsConnectionAdapterOptions {
              ServerCertificate = new X509Certificate2("certificate-server.pfx", "...")
            });
          });
          opts.Limits.MaxRequestBodySize = null;
        })
        .UseContentRoot(Directory.GetCurrentDirectory())
        .UseStartup&lt;Startup&gt;();
    }
  </code></pre>
  
  <h1>Update</h1>
  
  <p>Seems I am on the right track thanks to @chris-pratt. Changing the certificate cipher to <code>ECDSA_nistP256</code> make the web application work. But unfortunately I am using the cert to also sign the JWT tokens, and now that is broken with:</p>
  
  <blockquote>
    <p>System.NotSupportedException: The certificate key algorithm is not
    supported. at
    System.Security.Cryptography.X509Certificates.PublicKey.get_Key()</p>
  </blockquote>
  
  <p>The signing code is:</p>
  
  <pre><code>  var privateKey = new X509SecurityKey(new X509Certificate2("certificate-server.pfx", "..."));
    var token = new JwtSecurityToken(
      issuer: "Sentry",
      claims: claims,
      notBefore: DateTime.Now,
      expires: DateTime.Now.AddDays(1),
      signingCredentials: new SigningCredentials(privateKey, SecurityAlgorithms.RsaSha256Signature));
  
    return new JwtSecurityTokenHandler().WriteToken(token);
  </code></pre>
  
  <p>I tried changing the <code>SecurityAlgorithms</code> enum but did not get any success.</p>