Windows 10: Does SChannel support TLS 1.3 ? Do we have example client/server programs in C/C++ for...

I found SChannel.h defined SP_PROT_TLS1_3_CLIENT 0x00002000. But https://docs.microsoft.com/en-us/windows/win32/api/schannel/ns-schannel-schannel_cred#see-also grbitEnabledProtocols not mentioned about TLS1.3. I was unable to find any other internet information to document that SChannel support TLS1.3.

:)

 

When will TLS 1.3 be available in SCHANNEL?

I have not been able to find any official information about the implementation of TLS 1.3 security protocol in Windows 10.

In particular the SCHANNEL api which implements cryptography on streams that for example, a web server would use, like IIS.

Information on this is important as we must implement an SCHANNEL server which supports TLS 1.3 well before the previous versions are considered deprecated on the web. SSLLABS is adding a warning to our security test which states:

This server supports TLS 1.0 and TLS 1.1. Grade will be capped to B from January 2020.

So, in January, which is 2 months away, only TLS 1.2 will still be considered grade A security, and of course it will expire soon as well, as TLS 1.3 is a major improvement to 1.2.

We need lead time to implement and test TLS 1.3 well before the expiration of older protocols.

And yet, as of this time (11/11/2019) there has been no information on the Windows timeframe for support of TLS 1.3.

Please give us more information on the topic of TLS 1.3 security protocol.

 

When will TLS 1.3 be available in SCHANNEL?

Hi,

Thank you for writing to Microsoft Community Forums.

We understand your concern as you want to know, when TLS 1.3 will be available in SCHANNEL.

Let me point you in the right direction, where you would get the appropriate help for this issue. I would suggest you to post your query in
TechNet forums, where
we have experts and support professionals who are well equipped with the knowledge on TLS to assist you with the appropriate troubleshooting steps.

Please refer this article:
Transport Layer Security (TLS) best practices with the .NET Framework

Regards,

Aditya Roy

Microsoft Community – Moderator

 

Unable to run TLS 1.2

Hello,

I'm using Cisco AnyConnect Secure Mobility Client for Windows (Windows 10) v 4.8.

I'm trying to to connect using it to the server with TLS 1.2 but I failed because the VPN client uses only TLS 1.0. This client doesn't have TLS implementation, it uses Windows one.

I did a lot of registry changes to activate TLS 1.2 support on Windows 10:

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS1.0\client\TLS1.0\DisabledByDefault=1, Enabled=0

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS1.0\client\TLS1.1\DisabledByDefault=1, Enabled=0

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS1.0\client\TLS1.2\DisabledByDefault=0, Enabled=1

HKLM\\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\DefaultSecureProtocols=0xaa0

HKEY\LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\DefaultSecureProtocols=0xaa0

Don't know what to do more. Is any ready to use fix to enable TLS 1.2?