4

Yes, I rebooted the server. Several times.

This actually affects both TLS 1.1 and 1.2. The only one currently working is 1.0.

I followed the instructions here: http://support.microsoft.com/kb/245030

I've double checked all the names and values; I've had someone else double check all the names and values.

registry

Both Qualys and IE confirm that 1.1 and 1.2 are not functioning for multiple (presumably all) HTTPS-enabled sites on the server.

Any ideas on how to further investigate this would be awesome.

Edit: More screenshots.

registry2

windows-version

3
  • Question - Do you have the FIPS policy enabled? HKLM\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
    – Ryan Ries
    Nov 22, 2014 at 1:43
  • FIPS policy is disabled, but SSL v3 is also disabled separately.
    – pantsburgh
    Nov 22, 2014 at 9:22
  • I added the same in both client and server, still it didnt work after reboot the system. Any help would be highly appreciated.
    – user335645
    Feb 4, 2016 at 2:16

2 Answers 2

7

To enable the system to use the protocols that will not be negotiated by default (such as TLS 1.1 and TLS 1.2), change the DWORD value data of the DisabledByDefault value to 0x0 in the following registry keys under the Protocols key:

SCHANNEL\Protocols\TLS 1.1\Client

SCHANNEL\Protocols\TLS 1.1\Server

SCHANNEL\Protocols\TLS 1.2\Client

SCHANNEL\Protocols\TLS 1.2\Server

Try adding that to both TLS 1.1 and 1.2 under the Server key like you have it in the Client keys.

2
  • I'm going to try adding both Enabled (0x1) and DisabledByDefault (0x0) to both Server and Client keys. I'll reboot tonight and report back.
    – pantsburgh
    Nov 21, 2014 at 20:06
  • 2
    This fixed the issue.
    – pantsburgh
    Nov 22, 2014 at 9:12
0

Alternative solution is to use IIS Crypto.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.