How to Enable TLS 1.2 and TLS 1.3 on Windows Server

Growing trends in cyber attacks made system administrators implement more secured communication protocols to protect their assets and network from attacks. TLS plays a vital role in the implementation stack. TLS is a critical security protocol that is used to encrypt communications between clients and servers. TLS 1.2 and TLS 1.3 are the two latest versions of the Transport Layer Security (TLS) protocol and offer many advantages over their previous versions. TLS 1.2 is the most widely used version of the TLS protocol, but TLS 1.3 is gaining popularity. As a system administrator, you should enable TLS 1.2 and TLS 1.3 on your Windows Server to enhance the security of your infrastructure.

Before learning how to enable TLS 1.2 and TLS 1.3 on your Windows Server, let’s understand TLS 1.2 and TLS 1.3 and what these TLS protocols offer more than their predecessors.

A Short Note About TLS 1.2 and TLS 1.3: 

TLS is a cryptographic protocol that is used to secure communications over computer networks. TLS 1.2 and TLS 1.3 are the two latest versions of the Transport Layer Security (TLS) protocol. TLS 1.2 was finalized in 2008, and TLS 1.3 was finalized in 2018.

TLS 1.2 improves upon TLS 1.1 by adding support for Elliptic Curve Cryptography (ECC) and introducing new cryptographic suites that offer better security than the suites used in TLS 1.1. TLS 1.3 improves upon TLS 1.2 by simplifying the handshake process and making it more resistant to man-in-the-middle attacks. In addition, TLS 1.3 introduces new cryptographic suites that offer better security than the suites used in TLS 1.2.

TLS 1.2 and TLS 1.3 are both backward compatible with TLS 1.1 and earlier versions of the protocol. This means that a client that supports TLS 1.2 can communicate with a server that supports TLS 1.1 and vice versa. However, TLS 1.2 and TLS 1.3 are not compatible with each other. A client that supports TLS 1.2 cannot communicate with a server that supports TLS 1.3, and vice versa.

TLS 1.2 is the most widely used version of the TLS protocol, but TLS 1.3 is gaining in popularity. Many major web browsers, including Google Chrome, Mozilla Firefox, and Microsoft Edge, now support TLS 1.3. In addition, major Internet service providers, such as Cloudflare and Akamai, have started to support TLS 1.3 on their servers. Please visit this page if you want to deeply review the comparison of TLS implementations across different supported servers and clients.

Please visit these posts to learn more about TLS 1.2 and TLS 1.3:

  1. What Is SSL/TLS? How SSL, TLS 1.2, And TLS 1.3 Differ From Each Other?
  2. Decoding TLS v1.2 protocol Handshake with Wireshark
  3. Decoding TLS 1.3 Protocol Handshake With Wireshark
  4. How to Enable TLS 1.3 in Standard Web Browsers?
  5. How to Enable TLS 1.3 on Popular Web Servers?

TLS 1.3 is the most secure version of the TLS protocol and is the recommended version to use for all new deployments. However, TLS 1.2 is still widely used and will continue to be supported for the foreseeable future.

Why Should You Enable TLS 1.2 and TLS 1.3 on Windows Server?

As a windows administrator, it is not just your duty to take care the system’s health. But, it is also your responsibility to create a secure environment to protect your Windows from internal and external threats. TLS 1.2 and TLS 1.3 are the new and most secure transport layer security protocols. As a system administrator, you should enable TLS 1.2 and TLS 1.3 on your Windows Server for the following reasons:

  1. Both TLS 1.2 and TLS 1.3 introduces new cryptographic suites that offer better security than the suites used in older TLS and SSL protocols.
  2. Both TLS 1.2 and TLS 1.3 are more resistant to man-in-the-middle attacks and simplify the handshake process, which makes it more difficult for attackers to eavesdrop on communications.
  3. TLS 1.3 simplifies the handshake process and removes unnecessary cryptographic overhead, which results in a faster connection time.

How to Enable TLS 1.2 and TLS 1.3 on Windows Server?

We have covered 3 different ways to enable TLS 1.2 and TLS 1.3 on your Windows Server in this post. You can choose any one of the three ways to enable TLS 1.2 and TLS 1.3 on your Windows Server depending on your technical and automation skills.

  1. Enable TLS 1.2 and TLS 1.3 manually using Registry
  2. Enable TLS 1.2 and TLS 1.3 using Powershell Commands
  3. Enable TLS 1.2 and TLS 1.3 using CMD

Note: Microsoft clearly said that it supports TLS 1.3 only after Windows 11 & Windows Server 2022 operating systems. No support will be provided for TLS 1.3 below Windows 10 and Windows Server 2019. You can refer to the below table that shows the Microsoft Schannel Provider support of TLS protocol versions.

TLS Protocols Supported by Windows Operating Systems:

Windows OS TLS 1.0 Client TLS 1.0 Server TLS 1.1 Client TLS 1.1 Server TLS 1.2 Client TLS 1.2 Server TLS 1.3 Client TLS 1.3 Server
Windows Vista/Windows Server 2008 Enabled Enabled Not supported Not supported Not supported Not supported Not supported Not supported
Windows Server 2008 with Service Pack 2 (SP2) Enabled Enabled Disabled Disabled Disabled Disabled Not supported Not supported
Windows 7/Windows Server 2008 R2 Enabled Enabled Disabled Disabled Disabled Disabled Not supported Not supported
Windows 8/Windows Server 2012 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 8.1/Windows Server 2012 R2 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 1507 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 1511 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 1607/Windows Server 2016 Standard Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 1703 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 1709 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 1803 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 1809//Windows Server 2019 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 1903 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 1909 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 2004 Enabled Enabled Enabled Enabled Enabled Enabled Not supported Not supported
Windows 10, version 20H2 Enabled Enabled Enabled Enabled Enabled Enabled Not Supported Not Supported
Windows 10, version 21H1 Enabled Enabled Enabled Enabled Enabled Enabled Not Supported Not Supported
Windows 10, version 21H2 Enabled Enabled Enabled Enabled Enabled Enabled Not Supported Not Supported
Windows Server 2022 Enabled Enabled Enabled Enabled Enabled Enabled Enabled Enabled
Windows 11 Enabled Enabled Enabled Enabled Enabled Enabled Enabled Enabled

Method 1 : Enable TLS 1.2 and TLS 1.3 manually using Registry

Let’s begin learning how to enable TLS 1.2 and TLS 1.3 manually using Windows Registry.

Time needed: 10 minutes.

Method 1 : Enable TLS 1.2 and TLS 1.3 manually using Registry

  1. Open regedit utility

    Open ‘Run‘, type ‘regedit‘ and click ‘OK‘.Open regedit utility on Windows

  2. Create New Key

    In Registry Editor, navigate to the path : HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols
    Create a new key by Right click on ‘Protocols‘ –> New –> KeyCreate New Key on Windows

  3. Rename the Registry Key ‘TLS 1.2’

    Rename the  registry key as ‘TLS 1.2‘.Rename the Registry Key 'TLS 1.2'

  4. Create One More Registry Key ‘Client’ underneath ‘TLS 1.2’

    As smiler to the above step, create another key as ‘Client‘ underneath ‘TLS 1.2‘ as shone in this picture.Create One More Registry Key 'Client' underneath 'TLS 1.2'

  5. Create New Item ‘DWORD (32-bit) Value’ Underneath ‘Client’, select ‘New’

    Create new  item by right click on ‘Client‘, select ‘New’ –> DWORD (32-bit) Value.Create New Item 'DWORD (32-bit) Value' Underneath 'Client', select 'New'

  6. Rename the Item ‘DWORD (32-bit) Value’ to ‘DisableBy Default’

    Name the item as ‘DisableBy Default’ with Hexadecimal value as ‘0’.Rename the Item 'DWORD (32-bit) Value' to 'DisableBy Default'

  7. Create another item, ‘Enabled’ Underneath TLS 1.2

    Similarly create another item, ‘Enabled‘ with Hexadecimal value as ‘1‘.Create another item, 'Enabled' Underneath TLS 1.2

  8. List of Item Created underneath ‘Client’

    After registry item creations underneath ‘Client’, it looks as below.List of Item Created underneath 'Client'

  9. Create ‘Server’ and corresponding Keys as in the case of ‘Client’

    Similar to above steps, create a key ‘Server’ under ‘Protocols’ and create ‘DWORD (32-bit)’ and ‘Enabled’ as shown below.

    – HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Server/Enabled with Hexadecimal value as ‘1’
    – HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Server/DisabledByDefault with Hexadecimal value as ‘0’Create 'Server' and corresponding Keys as in the case of 'Client'

  10. Enable TLS 1.3 on the Windows Server

    Similar to above steps, create a ‘DWORD (32-bit)’ and ‘Enabled’ items in the below path to enable TLS 1.3

    Note: TLS 1.3 is supported in Windows 11 & Windows server 2022 onwards.

    – HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/HTTP/Parameters/EnableHTTP3 with Hexadecimal value as ‘1’Enable TLS 1.3 on the Windows Server

Method 2 : Enable TLS 1.2 and TLS 1.3 on Windows Server using Powershell Commends

Follow this simple procedure to enable TLS 1.2 and TLS 1.2 using Powershell comments.

  1. Open Powershell as Administrator
Opening Powershell as Administrator on Windows

2. Run below commands to create Registry entry

TLS 1.2
- New-Item 'HKLM:/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Client' -Force

- New-ItemProperty -Path 'HKLM:/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Client' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '0'

- New-ItemProperty -Path 'HKLM:/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Client' -PropertyType 'DWORD' -Name 'Enabled' -Value '1'



- New-Item 'HKLM:/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Server' -Force

- New-ItemProperty -Path 'HKLM:/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Server' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '0'

- New-ItemProperty -Path 'HKLM:/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Server' –PropertyType 'DWORD' -Name 'Enabled' -Value '1'



TLS 1.3 (Supports in Windows 11 & Windows Server 2022) 
- New-ItemProperty -Path 'HKLM:/SYSTEM/CurrentControlSet/services/HTTP/Parameters' -PropertyType 'DWORD' -Name 'EnableHttp3' -Value '1'

Before running the commands you can see no items were exist underneath Protocol.

No items were exist underneath Protocol

After running the commands you can see there are two keys created ‘TLS 1.2’ & ‘TLS 1.3’, Underneath each protocols there are ‘Client’ &’Server’ Keys inside them ther are two items ‘DisableByDefault’ & ‘Enabled’.

List of Item Created underneath 'Client' using PowerShell Commends
List of Item Created underneath 'Server' using PowerShell Commends
Enable TLS 1.3 on the Windows Server

Method 3: Enable TLS 1.2 and TLS 1.3 on Windows Server using native CMD

Follow this simple procedure to enable TLS 1.2 and TLS 1.2 using CMD comments.

  1. Open ‘Command Prompt’ as Administrator
Open 'Command Prompt' as Administrator on the Windows Server

2. Run below commands to create Registry entry.

TLS 1.2
- reg add "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Client" /v DisabledByDefault /t REG_DWORD /d 0 /f

- reg add "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Client" /v Enabled /t REG_DWORD /d 1 /f


- reg add "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Server" /v DisabledByDefault /t REG_DWORD /d 0 /f

- reg add "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/SecurityProviders/SCHANNEL/Protocols/TLS 1.2/Server" /v Enabled /t REG_DWORD /d 1 /f



TLS 1.3 (Supports in Windows 11 & Windows Server 2022)
- reg add "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/services/HTTP/Parameters" /v EnableHttp3 /t REG_DWORD /d 1 /f

We hope this post will help you know how to enable TLS 1.2 and TLS 1.3 on your Windows Server to enhance the security of your infrastructure. Please share this post if you find this interested. Visit our social media page on FacebookLinkedInTwitterTelegramTumblr, & Medium and subscribe to receive updates like this.

原创文章,作者:ItWorker,如若转载,请注明出处:https://blog.ytso.com/tech/aiops/288310.html

(0)
上一篇 2022年9月11日 20:57
下一篇 2022年9月11日 21:40

相关推荐

发表回复

登录后才能评论