Poco NetSSL_Win + TLS 1.3 Error SSL Exception: Failed to acquire Schannel credentials

[wallislander-collab]

I am using the code below and encountering the following error:

“Server error: SSL Exception: Failed to acquire Schannel credentials: The client and server cannot communicate because they do not possess a common algorithm.”

I am using a self-signed certificate created following the NetSSL_Win documentation, and I have installed it in the Local User certificate store on Windows. I am running Windows 11 and TLS 1.3 is enabled.

A thing to mention is that no client was attempting to connect and that the same certicate and same code works for TLS 1.2

I would appreciate any guidance on how to resolve this issue, as I have been stuck on this error for several days.

#include <Poco/Net/NetSSL.h>
#include <Poco/Net/Context.h>
#include <Poco/Net/SecureServerSocket.h>
#include <Poco/Net/SecureStreamSocket.h>
#include <Poco/Net/SocketAddress.h>
#include <Poco/Exception.h>
#include <schannel.h>
#include <exception>
#include <iostream>
#include <string>
#include <cstdlib>

constexpr unsigned short kPort = 9443;
const std::string kServerCertificateSubject = "insertCN";
constexpr int kServerContextOptionsMachineStore = Poco::Net::Context::OPT_TRUST_ROOTS_WIN_CERT_STORE;

void runServer(Poco::Net::Context::Ptr context)
{
    try
    {
        Poco::Net::SocketAddress address("127.0.0.1", kPort);
        Poco::Net::SecureServerSocket serverSocket(address, 64, context);
        std::cout << "TLS server listening on 127.0.0.1:" << kPort << std::endl;

        while (true)
        {
            Poco::Net::SecureStreamSocket client(serverSocket.acceptConnection());
            char buffer[256] = {};
            const int received = client.receiveBytes(buffer, sizeof(buffer));
            if (received <= 0)
            {
                continue;
            }

            std::string request(buffer, received);
            std::cout << "Server received: " << request << std::endl;

            const std::string response = "Echo over TLS -> " + request;
            client.sendBytes(response.data(), static_cast<int>(response.size()));
        }
    }
    catch (const Poco::Exception& ex)
    {
        std::cerr << "Server error: " << ex.displayText() << std::endl;
    }
    catch (const std::exception& ex)
    {
        std::cerr << "Server error: " << ex.what() << std::endl;
    }
}

int main()
{
    try
    {
        std::cout << "Starting Poco TLS server..." << std::endl;
        Poco::Net::initializeSSL();

        Poco::Net::Context::Ptr context = new Poco::Net::Context(
            Poco::Net::Context::TLS_SERVER_USE,
            kServerCertificateSubject,
            Poco::Net::Context::VERIFY_NONE,
            kServerContextOptionsMachineStore,
            Poco::Net::Context::CERT_STORE_MY);

        context->requireMinimumProtocol(Poco::Net::Context::PROTO_TLSV1_3);

        runServer(context);

        Poco::Net::uninitializeSSL();
    }
    catch (const Poco::Exception& ex)
    {
        std::cerr << "Fatal Poco exception: " << ex.displayText() << std::endl;
    }
    catch (const std::exception& ex)
    {
        std::cerr << "Fatal std::exception: " << ex.what() << std::endl;
    }
    catch (...)
    {
        std::cerr << "Fatal unknown exception." << std::endl;
    }

    return 0;
}