0

We have tried to disable weak SSL/TLS protocols on a windows 2016 server by setting the corresonding registry keys as suggested here: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings#tls-10

We have created the following DWORDs:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000

After a restart of the server a scan like https://www.ssllabs.com/ssltest/index.html still reports that the server supports TLS 1.0 and 1.1. We have cleared the scan cache after the change, so it shouldn't be a cached result. I also get a 200 OK response by

Invoke-WebRequest https://MyServer -SslProtocol Tls

If I use a tool like IISCrypto it reports that the protocols are disabled.

Any ideas regarding why these protocols are not being disabled by the registry keys above are very welcome!

  • Exactly what did you disable and enable in IIS Crypto? – Michael Hampton Jul 29 at 20:32
  • @MichaelHampton, I didn't disable anything in IISCrypto, I just noticed the protocols corresponding to the registry keys above were disabled. – MBL Jul 30 at 6:14
  • I've now also disabled the client protocols, no change. – MBL Jul 30 at 6:15
3

Is your server directly exposed to the internet? It's not a common practice anymore. Usually there is a load balancer or reverse proxy in front of it these days. If there is, that's what the SSL labs scan is hitting and that's where you need to disable TLS 1.0 and 1.1.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.