We want to support web browsers utilizing TLS 1.1 and 1.2, which has been apparently implemented by Microsoft, but is turned off by default.

So I went searching on Google and discovered some pages everyone seems to be following:



However! It doesn't appear to be working for me. I have set both DWORD vaules for DisabledByDefault and Enabled for TLS 1.1 and 1.2. I can confirm my client is attempting to communicate with TLS 1.2, but the server only responds with 1.0. I've restarted IIS, but it didn't change the situation.

Microsoft points out: "WARNING: The DisabledByDefault value in the registry keys under the Protocols key does not take precedence over the grbitEnabledProtocols value that is defined in the SCHANNEL_CRED structure that contains the data for an Schannel credential."

Well, that's very vague to me. I can't find anywhere where SCHANNEL_CRED is defined or set, all I can determine that it's a structure defined in a Microsoft library. That's my only guess for why this isn't work, yet I can't find enough information on it to determine if it is the true problem.

  • 2
    I hate to ask the obvious, but did you reboot the server after changing the registry? Sep 23, 2011 at 15:36
  • Hmmm. In IIS Manager, I clicked "Restart" under 'Actions'.
    – Sam Rueby
    Sep 23, 2011 at 15:39
  • As @ShaneMadden indicated, these changes are deeper than IIS, so you need to restart the system to make sure all the changes are applied. Sep 23, 2011 at 15:39

4 Answers 4


Reboot. Changes to Schannel settings do not take effect until the system is rebooted.


The easiest way to make changes in Microsoft SChannel protocols and ciphers (including cipher ordering) is to use IIS Crypto which is a completely free tool that can be downloaded without any kind of annoying registration requirements.

The tool manipulates the registry keys under the covers however it does so in a controlled, proven and safe way. We use it regularly.

It is also worth noting that it can help in automation scenarios as it has a command line version in addition to a GUI version.

There is also a blog that discusses some of the changes and why they have been made. The tool tends to be kept up to date when SSL issues arise.


Enabling TLS 1.1 and 1.2 requires a reboot. Disabling RC4 and DH is directly without restarting the server or services.

If i remember correctly, disabling SSLv2 and SSLv3 was also instantly effective.



To enable the protocol, change the DWORD value to 0xffffffff.

  • to enable protocol is 0xffffffff or 1 ? Aug 26, 2016 at 20:54
  • That link on this answer says the value must be 1, it doesn't mention fff... anywhere Jan 24, 2017 at 4:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.