Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default.

So I went searching on Google and discovered some pages everyone seems to be following:

http://support.microsoft.com/kb/245030

http://derek858.blogspot.com/2010/06/enable-tls-12-aes-256-and-sha-256-in.html

However! It doesn't appear to be working for me. I have set both DWORD vaules for DisabledByDefault and Enabled for TLS 1.1 and 1.2. I can confirm my client is attempting to communicate with TLS 1.2, but the server only responds with 1.0. I've restarted IIS, but it didn't change the situation.

Microsoft points out: "WARNING: The DisabledByDefault value in the registry keys under the Protocols key does not take precedence over the grbitEnabledProtocols value that is defined in the SCHANNEL_CRED structure that contains the data for an Schannel credential."

Well, that's very vague to me. I can't find anywhere where SCHANNEL_CRED is defined or set, all I can determine that it's a structure defined in a Microsoft library. That's my only guess for why this isn't work, yet I can't find enough information on it to determine if it is the true problem.

share|improve this question
    
I hate to ask the obvious, but did you reboot the server after changing the registry? –  Coding Gorilla Sep 23 '11 at 15:36
    
Hmmm. In IIS Manager, I clicked "Restart" under 'Actions'. –  Sam.Rueby Sep 23 '11 at 15:39
    
As @ShaneMadden indicated, these changes are deeper than IIS, so you need to restart the system to make sure all the changes are applied. –  Coding Gorilla Sep 23 '11 at 15:39

1 Answer 1

up vote 15 down vote accepted

Reboot. Changes to Schannel settings do not take effect until the system is rebooted.

share|improve this answer
    
You're a professional. –  Sam.Rueby Sep 23 '11 at 15:49
    
I don't have the reputation to up-vote this. –  Sam.Rueby Sep 23 '11 at 17:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.