How To Check Tls Version In Windows Server 2012 R2

Transport Layer Security (TLS) are cryptographic protocols designed to provide communications security over a estimator network, typically between a website and a browser.

TLS i.0 and its deprecated predecessor, SSL are vulnerable to some well-known security issues such as POODLE and BEAST attacks. According to NIST, these vulnerabilities cannot be stock-still or patched, therefore all companies, particularly banks and other fiscal institutions who are notoriously boring in upgrading theirs systems, need to upgrade to a secure alternative every bit presently equally possible, and disable whatever fallback to both SSL and the older TLS 1.0.

As of 30 June 2018, SSL and TLS ane.0 should exist disabled and more secure encryption protocol such as TLS 1.2 (or at the minimum TLS i.1) is required to come across the PCI Data Security Standard (PCI DSS) for safeguarding payment data.

The next question then how on practice we enable TLS 1.2 on Windows Servers? Specially on older servers such as Windows Server 2008 as many companies are not on the latest and greatest operating systems?

This post will address what to look for and how to enable TLS 1.2 as the default protocol for Windows Server 2012 R2 or older.

IMPORTANT: As e'er and it's worth repeating, you need to fill-in your current registry settings before attempting any of these changes on your servers.

Enable TLS one.two on Windows Servers 2008 SP2 or later

The blanket statement to enable your TLS 1.2 on your server from Windows Server 2008 SP2 or later. Microsoft provided an update to add back up for TLS one.1 and TLS 1.2 for Windows Server 2008, but it requires Windows Server 2008 SP2 installed.

And then only to state the obvious, TLS 1.one and TLS 1.2 are non supported for 32-scrap Windows Server 2008 SP1.

Launch regedit.exe.

In registry, go to:

                HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Create a new DWORD entry with a name TLS one.ii and create some other subkey Client and Server.
Under the subkey Server, create another DWORD Enabled with a value of 1.
Still nether the subkey Server, create a DWORD DisabledByDefault with a value of 0.
You must create a subkey DisabledByDefault entry in the advisable subkey (Client, Server) and set the DWORD value to 0 since this entry is set to 1 by default.
Reboot the server and test.

Enable TLS one.two on .Cyberspace Framework 3.5 (including 2.0)

.Net Framework 3.5 or earlier did not originally provide back up of applications to use TLS System Default Versions as a cryptographic protocol. However, for Windows Server 2012 R2, check if KB3154520 is installed (or KB3154519 for Windows Server 2012; KB3154518 for Windows Server 2008 R2; KB3154517 for Windows Server 2008 SP2).

How to check the KB updates

Right-click on the Windows button and select Programs and Features.
On Programs and Features window, click onthe View installed updates on the left pane.
You volition see a list of the updates that you tin can narrow downwards or do a very specific search past using the Search Installed Updates box. You tin can type in the KB number (i.due east., "KB3154520").
If the corresponding KB is already installed, we just need to enable information technology via registry modify. Otherwise, you lot need to install the patch from either of the links for Windows Server 2012 R2 (or use the same corresponding links above for earlier versions of Windows Server).

Registry Alter

Launch regedit.exe.

Go to:

                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727

Create a new entry SystemDefaultTlsVersions with a DWORD value set to 1.
Create a new entry SchUseStrongCrypto with a DWORD value prepare to one.

Go to:

                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319

Create a new entry SystemDefaultTlsVersions with a DWORD value set to 1.
Create a new entry SchUseStrongCrypto with a DWORD value fix to 1.

For 64-bit Bone, the same changes too needed for the following locations:

                HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727

Create a new entry SystemDefaultTlsVersions with a DWORD value set to i.
Create a new entry SchUseStrongCrypto with a DWORD value set to 1.

Go to:

                HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319

Create a new entry SystemDefaultTlsVersions with a DWORD value set to 1.
Create a new entry SchUseStrongCrypto with a DWORD value gear up to 1.
Test.

Enable TLS 1.2 as default for WinHTTP

This may exist applicable for any Classic ASP or VB6 applications that use WinHTTP. Prior to Windows ten and Windows Server 2016, TLS i.i or 1.2 is non enabled by default for customer-server communications through WinHTTP.

To set TLS i.ii by default, do the following:

Create a registry entry DefaultSecureProtocols on the following location:

                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp

Fix the DWORD value to 800 for TLS 1.ii.

For 64-fleck Os, repeat step ane and two on the following location:

                HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Cyberspace Settings\WinHttp

Reboot the server and test.

Windows 10 and Windows Server 2016/2019 support TLS 1.ii for client-server communications by using WinHTTP.

Purchase me a coffee?

If you notice this post helpful and would like to purchase me a java to support the work here, you'll have our large thanks!
Support It Nota: Buy Me a Coffee