GraphServiceClient hitting error 'A security error occurred'

[isPhilo]

I am trying to support TLS 1.3 in our .Net Framework 4.8 C# application. Calling GraphServiceClient gives a security error when only TLS 1.3 is enabled but works when both TLS 1.2 and 1.3 are enabled.

Error:
System.Net.Http.HttpRequestException
HResult=0x80131500
Message=An error occurred while sending the request.
Source=mscorlib
StackTrace:
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Kiota.Http.HttpClientLibrary.Middleware.BodyInspectionHandler.d__2.MoveNext()
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Kiota.Http.HttpClientLibrary.Middleware.HeadersInspectionHandler.d__2.MoveNext()
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
at Microsoft.Kiota.Http.HttpClientLibrary.Middleware.RedirectHandler.d__5.MoveNext()
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Kiota.Http.HttpClientLibrary.Middleware.RetryHandler.d__7.MoveNext()
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Kiota.Http.HttpClientLibrary.Middleware.UriReplacementHandler1.<SendAsync>d__2.MoveNext() at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.<GetHttpResponseMessageAsync>d__33.MoveNext() at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.<SendAsync>d__201.MoveNext()
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Graph.Me.MeRequestBuilder.d__151.MoveNext()
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
at TestMsGraphTls13.Program.

d__0.MoveNext() in C:\Users\administrator.xxx\Source\Repos\TestMsGraphTls13\TestMsGraphTls13\Program.cs:line 25
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
at TestMsGraphTls13.Program.(String[] args)

This exception was originally thrown at this call stack:
System.Threading.Tasks.RendezvousAwaitable.GetResult()
System.Net.Http.WinHttpHandler.StartRequestAsync(System.Net.Http.WinHttpRequestState)

Inner Exception 1:
WinHttpException: Error 12175 calling WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, 'A security error occurred'.

Code:
I created a standalone console app with these lines
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls13;

string[] scopes = { "User.Read.All" };
var usernamePasswordCredential = new UsernamePasswordCredential("user", "passw!", "tenantid", "clientid");

GraphServiceClient graphClient = new GraphServiceClient(usernamePasswordCredential, scopes);
var me = await graphClient.Me.GetAsync();

Works with both TLS 1.2 and 1.3 enabled
Fails when only TLS 1.3 is enabled.
Wireshark shows connnection with login.microsoft.com using tls 1.3 but then trying to use tls 1.2 with graph.microsoft.com

Created another console app using only httpclient to get auth code and then get users from graph.microsoft.com. httpclient only code works with only tls 1.3 enabled and confirmed in wireshark.

I think this rules out most environment misconfiguration.

Does graphserviceclient and WinHttp support TLS 1.3 or am I missing some other TLS configuration for graphserviceclient to work with TLS 1.3 only.

Similar issue: #2176

Windows Server 2022 standard(updated)
Visual studio 2019
Console App for graph service client uses latest stable Dlls from nuget.