We have tried to disable weak SSL/TLS protocols on a windows 2016 server by setting the corresonding registry keys as suggested here: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings#tls-10

We have created the following DWORDs:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]

After a restart of the server a scan like https://www.ssllabs.com/ssltest/index.html still reports that the server supports TLS 1.0 and 1.1. We have cleared the scan cache after the change, so it shouldn't be a cached result. I also get a 200 OK response by

Invoke-WebRequest https://MyServer -SslProtocol Tls

If I use a tool like IISCrypto it reports that the protocols are disabled.

Any ideas regarding why these protocols are not being disabled by the registry keys above are very welcome!

  • Exactly what did you disable and enable in IIS Crypto? Jul 29, 2020 at 20:32
  • @MichaelHampton, I didn't disable anything in IISCrypto, I just noticed the protocols corresponding to the registry keys above were disabled.
    – MBL
    Jul 30, 2020 at 6:14
  • I've now also disabled the client protocols, no change.
    – MBL
    Jul 30, 2020 at 6:15

1 Answer 1


Is your server directly exposed to the internet? It's not a common practice anymore. Usually there is a load balancer or reverse proxy in front of it these days. If there is, that's what the SSL labs scan is hitting and that's where you need to disable TLS 1.0 and 1.1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.