API on TLS 1.2

[airick]

For API, is DropBox going to be TLS 1.2 compliant?  On June 20, 2018, early versions of SSL/TLS will no longer be PCI compliant. I was testing the Dropbox API on a TLS 1.2 only server and get the error below. 

https://api.dropboxapi.com/2/sharing/create_shared_link_with_settings

System.ComponentModel.Win32Exception:
The client and server cannot communicate, because they do not possess a common algorithm at System.Net.SSPIWrapper.AcquireCredentialsHandle (SSPIInterface SecModule, String package, CredentialUse intent, SecureCredential scc)

[Greg-DB · Accepted solution]

The Dropbox API servers do support TLS 1.2, and it seems to be working correctly for me:

$ curl --tlsv1.2 -v -X POST "https://api.dropboxapi.com/2/sharing/create_shared_link_with_settings"
*   Trying 162.125.1.7...
* TCP_NODELAY set
* Connected to api.dropboxapi.com (162.125.1.7) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: api.dropboxapi.com
* Server certificate: DigiCert SHA2 High Assurance Server CA
* Server certificate: DigiCert High Assurance EV Root CA
> POST /2/sharing/create_shared_link_with_settings HTTP/1.1
> Host: api.dropboxapi.com
> User-Agent: curl/7.58.0
> Accept: */*
>
< HTTP/1.1 (remainder redacted for brevity)

An SSL Labs test confirms as much as well.

Based on the error output you shared, if you do have TLS 1.2 enabled, it looks like perhaps your client may not share any ciphers with the Dropbox API servers. The above SSL Labs test page lists the supported ciphers. Please check your client configuration and enable ciphers as necessary.

[Milan K]

In my case the problem was that I had disabled Diffie-Hellman Key exchange. After enabling it and restarting OS, Dropbox is working again.