Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default.

So I went searching on Google and discovered some pages everyone seems to be following:

http://support.microsoft.com/kb/245030

http://derek858.blogspot.com/2010/06/enable-tls-12-aes-256-and-sha-256-in.html

However! It doesn't appear to be working for me. I have set both DWORD vaules for DisabledByDefault and Enabled for TLS 1.1 and 1.2. I can confirm my client is attempting to communicate with TLS 1.2, but the server only responds with 1.0. I've restarted IIS, but it didn't change the situation.

Microsoft points out: "WARNING: The DisabledByDefault value in the registry keys under the Protocols key does not take precedence over the grbitEnabledProtocols value that is defined in the SCHANNEL_CRED structure that contains the data for an Schannel credential."

Well, that's very vague to me. I can't find anywhere where SCHANNEL_CRED is defined or set, all I can determine that it's a structure defined in a Microsoft library. That's my only guess for why this isn't work, yet I can't find enough information on it to determine if it is the true problem.

share|improve this question
1  
I hate to ask the obvious, but did you reboot the server after changing the registry? –  Coding Gorilla Sep 23 '11 at 15:36
    
Hmmm. In IIS Manager, I clicked "Restart" under 'Actions'. –  Sam.Rueby Sep 23 '11 at 15:39
    
As @ShaneMadden indicated, these changes are deeper than IIS, so you need to restart the system to make sure all the changes are applied. –  Coding Gorilla Sep 23 '11 at 15:39

2 Answers 2

up vote 24 down vote accepted

Reboot. Changes to Schannel settings do not take effect until the system is rebooted.

share|improve this answer
2  
You're a professional. –  Sam.Rueby Sep 23 '11 at 15:49
    
I don't have the reputation to up-vote this. –  Sam.Rueby Sep 23 '11 at 17:16

The easiest way to make changes in Microsoft SChannel protocols and ciphers (including cipher ordering) is to use IIS Crypto which is a completely free tool that can be downloaded without any kind of annoying registration requirements.

The tool manipulates the registry keys under the covers however it does so in a controlled, proven and safe way. We use it regularly.

It is also worth noting that it can help in automation scenarios as it has a command line version in addition to a GUI version.

There is also a blog that discusses some of the changes and why they have been made. The tool tends to be kept up to date when SSL issues arise.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.