Windows 10: Windows 10 TLS 1.3 Enablement Registry keys

We are deploying TLS 1.3 as a required protocol as well as Disabling TLS 1.1. On the 1909 version of software.


We are doing this via Registry Keys:


HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client DisablebyDefault == 0x1

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server DisablebyDefault == 0x1

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client Enabled == 0x0

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server Enabled == 0x0


HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client DisablebyDefault == 0x0

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server DisablebyDefault == 0x0

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client Enabled == 0x0

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server Enabled == 0x0


It follows that we need to control the DefaultSecureProtocols keys as well.


The docs lists the following values and how to calculate complex values by adding the Hex Values


## 0x00000008 Enable SSL 2.0 by default

## 0x00000020 Enable SSL 3.0 by default

## 0x00000080 Enable TLS 1.0 by default

## 0x00000200 Enable TLS 1.1 by default

## 0x00000800 Enable TLS 1.2 by default


Can we assume that TLS 1.3 follows the same pattern? e.g.

[COLOR=rgba215, 57, 0, 1]## 0x00002000[/COLOR] [COLOR=rgba215, 57, 0, 1]Enable TLS 1.3 by default[/COLOR]


We would set this on the following keys to only allow TLS 1.2 and TLS 1.3


HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp DefaultSecureProtocols == 0x2800

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp DefaultSecureProtocols == 0x2800
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings SecureProtocols == 0x2800

Thanks for any clarification you can give, I can not find this on the Docs site or developer pages, but I could be wrong.


Reference: SUPPORT SITE

:)

 

Microsoft Edge TLS Security

After trying everything (not a lot of steps) listed in the Microsoft Edge support site, I did a wider search and found this very simple youtube video that fixed it immediately:

For those who prefer not to click links the steps are simple:

1. Click in the Cortana search bar next to the Win 10 Start button

2. Type internet options

3. Select internet options (control panel) from the list

4. Click on the advanced tab

5. Scroll down to the security section

6. Make sure the following are all clicked:
Use SSL 3.0
Use TLS 1.0
Use TLS 1.1
Use TLS 1.2

7. Click apply

8. Refresh the page that was giving the error and it should now connect.

Hope this helps, it was a 30 second fix after hours of pounding my head against the error with the Support site suggestions.

 

TLS 1.1 AND TLS 1.2 are gray out

Hi,

Thank you for writing to Microsoft Community forum.

As per the TLS-SSL Settings article, for TLS 1.1 and 1.2 to be enabled and negotiated, you MUST create the
DisabledByDefault entry in the appropriate sub key (Client) and set it to
0. These sub keys will not be created in the registry since these protocols are disabled by default.

Create the necessary sub keys for TLS 1.1 and 1.2, create the DisabledByDefault
DWORD values and set it to 0 in the following locations.

Type Regedit in Start menu or taskbar search box and then press Enter key. Click
Yes button when you see the User Account Control dialog. In the Registry Editor, navigate to the following key:

For TLS 1.1:

• Go to the Registry location -HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client
  
• On the right-side, right-click on the empty space, click New, click
  DWORD (32-bit) Value, and name it as DisabledByDefault.
  
• Finally, double-click on
  DisabledByDefault, and set its value data to 0.
  

For TLS 1.2:

• Go to the Registry location - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client
  
• On the right-side, right-click on the empty space, click New, click
  DWORD (32-bit) Value, and name it as DisabledByDefault.
  
• Finally, double-click on
  DisabledByDefault, and set its value data to 0.
  
  

Registry Disclaimer: The registry is a database in Windows that contains important information about system hardware, installed programs and settings, and profiles of each of the user accounts on the computer. Windows often reads
and updates the information in the registry.

Normally, software programs make registry changes automatically. You should not make unnecessary changes to the registry. Changing registry files incorrectly can cause Windows to stop working or make Windows report the wrong information.

Please take a backup of the registry. Follow the steps given in the link below:

Link: How to back up and restore the registry in Windows

Regards,

Mala.S

Microsoft Community

 

TLS 1.2

Hi,

My name is Angel. I am an Independent Advisor. Thank you for posting in Microsoft Community.

To update to TLS 1.2 follow this instructions:

1. From Notepad.exe, create a text file named TLS12-Enable.reg.

2. Copy and paste the following text into the file.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]

"DisabledByDefault"=dword:00000000

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]

"DisabledByDefault"=dword:00000000

"Enabled"=dword:00000001

1. Save TLS12-Enable.reg.

2. Double-click the TLS12-Enable.reg file.

3. Click Yes to update your Windows Registry with these changes.

4. Restart the machine for the changes to take effect.

Registry disclaimer

To do so: Important this section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection,
back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

How to back up and restore the registry in Windows

How to back up and restore the registry in Windows

Hope the information provided is useful. If the issue persists, reply here and we will be glad to help you.

Angel.