Is it possible to enable TLS 1.1 and 1.2 on Windows Server 2008 SP2 (not R2) running IIS7?

I've tried changing the registry and using IIS Crypto to enable it but it seems its not working.

If its not possible then how could I mitigate the Beast attacks?

up vote 4 down vote accepted

Microsoft has released an update for Windows 2008 in 2017 which adds support for TLS 1.1 and 1.2 See @Chris Vesper's answer for the details.

Original:

Windows 2008 does not support TLS 1.1 and 1.2. You can mitigate beast by using a different cipher-suite (not involving RC4)

Have a look over at security.stackexchange.com: https://security.stackexchange.com/questions/14326/how-to-fix-ssl-2-0-and-beast-on-iis

  • I followed the selected answer in that link and Qualys SSL Labs is still showing that I am vulnerable to Beast attacks. – officeboi101 Apr 22 '14 at 17:26
  • 1
    Could you post the relavant parts from qualys ssl test? – MichelZ Apr 22 '14 at 18:26
  • Old question, but yes, you can get TLS working on server 2008 – Chris Vesper Apr 20 at 19:04
  • Updated answer to reflect current situation. Thanks @ChrisVesper – MichelZ Apr 24 at 15:20

We were able to get TLS 1.2 and 1.2 working on Server 2008 SP2.

We have a Win32 application being used on Server 2008 SP2 by numerous customers. The application needs to talk to credit card processing companies that only support TLS 1.2 as of April 2018.

Here is the procedure we followed:

  1. Install KB4019276 from https://www.catalog.update.microsoft.com/Search.aspx?q=KB4019276

  2. Create registry keys for TLS 1.1 and TLS 1.2. These keys are created under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols as documented here https://support.quovadisglobal.com/kb/a433/how-to-enable-tls-1_2-on-windows-server-2008-r2.aspx

  3. Enable TLS 1.1 and 1.2 in Internet Explorer 9 as documented here https://msfn.org/board/topic/176902-enabling-tls-1112-support-in-vistas-internet-explorer-9/

enter image description here

Detailed instructions from Step 2 above if the URL is dead.

  1. Browse to the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
  2. Right click on the Protocols folder and select New and then Key from the drop-down menu. This will create new folder. Rename this folder to TLS 1.2.

  3. Right click on the TLS 1.2 key and add two new keys underneath it.

  4. Rename the two new keys as: Client Server

  5. Right click on the Client key and select New and then DWORD (32-bit) Value from the drop-down list.

  6. Rename the DWORD to DisabledByDefault.

  7. Right-click the name DisabledByDefault and select Modify... from the drop-down menu.

  8. Ensure that the Value data field is set to 0 and the Base is Hexadecimal. Click on OK.

  9. Create another DWORD for the Client key as you did in Step 7.

  10. Rename this second DWORD to Enabled.

  11. Right-click the name Enabled and select Modify... from the drop-down menu.

12 Ensure that the Value data field is set to 1 and the Base is Hexadecimal. Click on OK.

  1. Repeat steps 5 to 12 for the Server key (by creating two DWORDs, DisabledByDefault and Enabled, and their values underneath the Server key).

  2. Reboot the server.

Detailed instructions from Step 3 above if the URL is dead.

  1. After installing KB4019276, launch regedit, preferably as Administrator, and navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\AdvancedOptions\CRYPTO\TLS1.1

  1. Delete the "OSVersion"="3.6.1.0.0" subkey)

  2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\AdvancedOptions\CRYPTO\TLS1.2

  3. Again, delete the "OSVersion"="3.6.1.0.0" subkey. Exit Registry Editor.

  4. Launch IE9; Tools -> Internet Options -> Advanced tab -> Scroll all the way down to "Security":

  5. Prior to KB4019276 and registry manipulations, only "Use TLS 1.0" had been available on Vista; you should have already unchecked the older "Use SSL 2.0/3.0" options, to avoid being targeted by "POODLE" attacks; uncheck "Use TLS 1.0" (optionally also "Use TLS 1.1") and check "Use TLS 1.2".

  6. Click Apply, OK, then exit IE9.

  7. Upon restarting IE9, you'll find you can now visit all those sites that previously would not load due to unsupported TLS protocols:

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.