Rationale

Today you can only configure the available CipherSuites (if at all) on a Machine Wide (maybe process maybe not) Level.

This is problematic let me give you a basic example

I have a webservice, it needs to connect to an internal "Legacy" service so I have to support some old or slow (DHE at large key sizes for instance) set of ciphers. But this means now my webserver has to support clients connecting to it with the same bad crypto.

Solution

Add a method to the SslStream Options bag that is a "list" of supported ciphers. Existing behaviour (System wide settings) would be used if the Cipher Suite List is unsupported.

Also add a few "sets" of industry standard suites to allow users to "fall into the pit of success".

API (With some ideas from @PeterSmithRedmond)

public class SslServerAuthenticationOptions
{
    public ReadOnlyCollection<CipherSuite> {get;set;}
}

public class SslClientAuthenticationOptions
{
     public ReadOnlyCollection<CipherSuite> {get;set;}
}

public struct CipherSuite
{
         public CipherSuite(string cipherSuiteName);

         public static ReadOnlyCollection<CipherSuite> FipsCipherSuite2017 {get;}
         public static ReadOnlyCollection<CipherSuite> MozillaModernCipherSuite {get;}
         public static ReadOnlyCollection<CipherSuite> MozillaIntermediateCipherSuite {get;}
         public static ReadOnlyCollection<CipherSuite> MozillaOldCipherSuite {get;}
         public static ReadOnlyColleciton<CipherSuite> OSStrongCipherSuite {get;}
}

The last one I am not 100% on.

The "defaults" will help people select the right choice.

Refs

dotnet/corefx#24389 This depends on the OptionBag in this issue
#22507 This feature wanted on the HttpClient/Handler which this would facilitate
#19914 A previous request