Pages

Wednesday, October 5, 2011

Enable TLS 1.1 and TLS 1.2 on Windows Server 2008 R2 and IIS 7.5

You are probably aware that SSL has been hacked - that is versions of SSL before 3.2 and TLS 1.1 are vulnerable. Thankfully Windows Server 2008 R2 comes with the capability to support TLS 1.1 and TLS 1.2; however, they are not enabled by default. I found some decent information on how to enable TLS 1.1 and TLS 1.2, but no straightforward instructions on how to do so. The bottom line is you have to edit the registry then reboot the server.

Update: This tool should make this job much easier: https://www.nartac.com/Products/IISCrypto/Default.aspx

But feel free to use the following information to do the job...

Here are the straightforward steps to enable TLS 1.1 and TLS 1.2 on a Windows Server 2008 R2 server:
  1. Please backup your registry.
  2. Start the registry editor (regedit)
  3. Browse to the following registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
  4. Add the following keys:
    TLS 1.1 and TLS 1.2
  5. Within each of the TLS 1.1 and TLS 1.2 keys (they look like folders), add these keys: Client and Server
  6. Within each of the Client and Server keys, create the following DWORD values:
    • DisabledByDefault with a value of 0
    • Enabled with a value of 1
  7. Reboot the server.
You should now have registry settings that look like:


I tested the new settings by configuring Internet Explorer 9 to only use TLS 1.2 and connected to a secure page on one of the websites on my server. Here is where you configure IE9 to do this:


Do your customers a favor (and thus yourself) by allowing them to use a more secure version of SSL/TLS on your website. Configure your IIS server to use TLS 1.1 and TLS 1.2. Hopefully all web browsers will support these versions in the very-near future - but at least Internet Explorer 9 already does.
Posted by at
Labels:

11 comments:

  1. Thanks! This is exactly what I needed.

    I wonder why all active protocols (ie, SSL 3.0 and TLS 1.0) aren't listed as Reg keys? It makes it a bit confusing to keep track of what is on and what is off on a server. I ended up using https://www.ssllabs.com/ssldb/index.html to check my server.

    ReplyDelete

  2. I'm glad this helped you. And thank you for the link to ssl labs - very useful!

    ReplyDelete

  3. [...] Should Disable SSL 2.0 Nov.15, 2011 in IIS, Web Site Administration, Windows In my previous post Enable TLS 1.1 and TLS 1.2 in IIS, I discussed how to enable TLS 1.1 and TLS 1.2. Now I want to take that a step further by disabling [...]

    ReplyDelete

  4. Use this tool it is a lot easier

    https://www.nartac.com/Products/IISCrypto/Default.aspx

    ReplyDelete
    Replies

    1. worked like a charm and super easy, thanks!

      Delete

  5. @Rovastar: Thanks for the link to the excellent IIS Crypto tool!

    ReplyDelete

  6. I could configure ssl in my server in cloud with the help of this post. Thank yo.

    ReplyDelete

  7. Thanks for the article. I followed the steps to changing/adding the registry keys but when I use ssllabs.com to scan my site after the reboot it still says that the TLS 1.1 and TLS 1.2 are not enabled. Any ideas on why the change isn't being picked up?

    ReplyDelete
    Replies

    1. Try using this tool instead and see if you have better luck: https://www.nartac.com/Products/IISCrypto/Default.aspx

      Delete

  8. Just a word of caution - if you switch off TLS 1.0 using the Nartac tool, you actually loose the possibility to connect using RDP.....

    ReplyDelete

  9. Hi

    I ran the fix tools from Microsoft MS12-006 (http://support.microsoft.com/kb/2643584). Fix it solution for TLS 1.1 on Internet Explorer (Microsoft Fix it 50773)and Fix it solution for TLS 1.1 on Windows-based servers (Microsoft Fix it 50774). I also utilized this tool from https://www.nartac.com/Products/IISCrypto/Default.aspx and removed tls 1.0 via PCI button. After I rebooted the server, it couldn't boot to the windows screen, it displayed microsoft corporation meter bar and it gave me the black screen. I tried to boot to last known configuration and restored the full registry; however, it gave me the error that it couldn't import it. I don't know what happens if I restart the server again. Any ideas? Please help. Thanks.

    Peter

    **************************************
    I had this path on the windows server, but it still failed the BEAST scan.

    Windows Server 2008 R2 for x64-based Systems Service Pack 1*
    (KB2585542) Information Disclosure Important No bulletin replaced by KB2585542

    ReplyDelete

Subscribe to: Post Comments (Atom)