TLS1.0 missing from Windows 2008 protocolsUpgrade from Windows Server 2008 to Server 2008 R2 RCWhat's the...
Create chunks from an array
Are all UTXOs locked by an address spent in a transaction?
Can a space-faring robot still function over a billion years?
Has Wakanda ever accepted refugees?
Convergence to a fixed point
Can we carry rice to Japan?
“I had a flat in the centre of town, but I didn’t like living there, so …”
1970s scifi/horror novel where protagonist is used by a crablike creature to feed its larvae, goes mad, and is defeated by retraumatising him
Is every open circuit a capacitor?
Was it really inappropriate to write a pull request for the company I interviewed with?
How can I handle a player who pre-plans arguments about my rulings on RAW?
Why won't the strings command stop?
Draw bounding region by list of points
If nine coins are tossed, what is the probability that the number of heads is even?
PTIJ: What’s wrong with eating meat and couscous?
Why do phishing e-mails use faked e-mail addresses instead of the real one?
Split a number into equal parts given the number of parts
How can I highlight parts in a screenshot
Why are special aircraft used for the carriers in the United States Navy?
PTIJ: Aharon, King of Egypt
Would the melodic leap of the opening phrase of Mozart's K545 be considered dissonant?
Wardrobe above a wall with fuse boxes
How does insurance birth control work?
How to mitigate "bandwagon attacking" from players?
TLS1.0 missing from Windows 2008 protocols
Upgrade from Windows Server 2008 to Server 2008 R2 RCWhat's the difference between Windows Server 2008, 2008 SP2 and 2008 R2?How to enable TLS 1.1, 1.2 in IIS 7.5RC4 cipher not working on Windows 2008 R2 / IIS 7.5Tls1.0 between client and server Windows not workingIs it possible to configure ARR to make TLS 1.2 outgoing connections in Server 2008 R2?Exchange 2010 OWA not workingCheck if Windows Server 2008R2 can use TLS 1.2TLS Error 70 issuesEnabling TLS 1.1/1.2 on Windows Server 2008 SP2 still not possible
I have two Windows Server 2008 R2 machines that came back with a weak cipher vulnerability for TLS1_RSA_DES_192_CBC3_SHA. I wanted to see if it were possible to just disable TLS 1.0 as the same report came back that anything under 1.2 was considered vulnerable. However, when I started to drill down the registry I found under SCHANNELProtocols only SSL 2.0 and SSL 3.0, both of which area already disabled.
This KBA indicates I should see TLS 1.0 given the OS version I'm running. Having not run into this scenario before, what are my options to disable this cipher or protocol? Can I just add the missing TLS 1.0 / Client / Server keys and disable them? Should I try to target the cipher specifically? Or are there other options?
windows-server-2008 windows-server-2008-r2
asked Oct 25 '16 at 13:24
imtpnetimtpnet
12
bumped to the homepage by Community♦ 8 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
I have two Windows Server 2008 R2 machines that came back with a weak cipher vulnerability for TLS1_RSA_DES_192_CBC3_SHA. I wanted to see if it were possible to just disable TLS 1.0 as the same report came back that anything under 1.2 was considered vulnerable. However, when I started to drill down the registry I found under SCHANNELProtocols only SSL 2.0 and SSL 3.0, both of which area already disabled.
This KBA indicates I should see TLS 1.0 given the OS version I'm running. Having not run into this scenario before, what are my options to disable this cipher or protocol? Can I just add the missing TLS 1.0 / Client / Server keys and disable them? Should I try to target the cipher specifically? Or are there other options?
windows-server-2008 windows-server-2008-r2
asked Oct 25 '16 at 13:24
imtpnetimtpnet
12
bumped to the homepage by Community♦ 8 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
Try nartac.com/Products/IISCrypto. It gives you a nice interface for adjusting these settings. The "Best Practices" button is great.
– longneck
Oct 25 '16 at 13:35
add a comment |
I have two Windows Server 2008 R2 machines that came back with a weak cipher vulnerability for TLS1_RSA_DES_192_CBC3_SHA. I wanted to see if it were possible to just disable TLS 1.0 as the same report came back that anything under 1.2 was considered vulnerable. However, when I started to drill down the registry I found under SCHANNELProtocols only SSL 2.0 and SSL 3.0, both of which area already disabled.
This KBA indicates I should see TLS 1.0 given the OS version I'm running. Having not run into this scenario before, what are my options to disable this cipher or protocol? Can I just add the missing TLS 1.0 / Client / Server keys and disable them? Should I try to target the cipher specifically? Or are there other options?
windows-server-2008 windows-server-2008-r2
asked Oct 25 '16 at 13:24
imtpnetimtpnet
12
I have two Windows Server 2008 R2 machines that came back with a weak cipher vulnerability for TLS1_RSA_DES_192_CBC3_SHA. I wanted to see if it were possible to just disable TLS 1.0 as the same report came back that anything under 1.2 was considered vulnerable. However, when I started to drill down the registry I found under SCHANNELProtocols only SSL 2.0 and SSL 3.0, both of which area already disabled.
This KBA indicates I should see TLS 1.0 given the OS version I'm running. Having not run into this scenario before, what are my options to disable this cipher or protocol? Can I just add the missing TLS 1.0 / Client / Server keys and disable them? Should I try to target the cipher specifically? Or are there other options?
windows-server-2008 windows-server-2008-r2
windows-server-2008 windows-server-2008-r2
asked Oct 25 '16 at 13:24
imtpnetimtpnet
12
asked Oct 25 '16 at 13:24
imtpnetimtpnet
12
asked Oct 25 '16 at 13:24
imtpnetimtpnet
12
asked Oct 25 '16 at 13:24
imtpnetimtpnet
12
asked Oct 25 '16 at 13:24
imtpnetimtpnet
12
12
bumped to the homepage by Community♦ 8 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 8 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
Try nartac.com/Products/IISCrypto. It gives you a nice interface for adjusting these settings. The "Best Practices" button is great.
– longneck
Oct 25 '16 at 13:35
add a comment |
Try nartac.com/Products/IISCrypto. It gives you a nice interface for adjusting these settings. The "Best Practices" button is great.
– longneck
Oct 25 '16 at 13:35
Try nartac.com/Products/IISCrypto. It gives you a nice interface for adjusting these settings. The "Best Practices" button is great.
– longneck
Oct 25 '16 at 13:35
Try nartac.com/Products/IISCrypto. It gives you a nice interface for adjusting these settings. The "Best Practices" button is great.
– longneck
Oct 25 '16 at 13:35
add a comment |
1 Answer
1
active
oldest
votes
Create and run the following PowerShell script:
# Enables TLS 1.2 on Windows Server 2008 R2 and Windows 7
# These keys do not exist so they need to be created prior to setting values.
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client"
# Enable TLS 1.2 for client and server SCHANNEL communications
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client" -name "Enabled" -value 1 -PropertyType "DWord"
answered Oct 25 '16 at 13:48
AntoineAntoine
1507
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f811169%2ftls1-0-missing-from-windows-2008-protocols%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Create and run the following PowerShell script:
# Enables TLS 1.2 on Windows Server 2008 R2 and Windows 7
# These keys do not exist so they need to be created prior to setting values.
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client"
# Enable TLS 1.2 for client and server SCHANNEL communications
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client" -name "Enabled" -value 1 -PropertyType "DWord"
answered Oct 25 '16 at 13:48
AntoineAntoine
1507
add a comment |
Create and run the following PowerShell script:
# Enables TLS 1.2 on Windows Server 2008 R2 and Windows 7
# These keys do not exist so they need to be created prior to setting values.
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client"
# Enable TLS 1.2 for client and server SCHANNEL communications
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client" -name "Enabled" -value 1 -PropertyType "DWord"
answered Oct 25 '16 at 13:48
AntoineAntoine
1507
add a comment |
Create and run the following PowerShell script:
# Enables TLS 1.2 on Windows Server 2008 R2 and Windows 7
# These keys do not exist so they need to be created prior to setting values.
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client"
# Enable TLS 1.2 for client and server SCHANNEL communications
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client" -name "Enabled" -value 1 -PropertyType "DWord"
answered Oct 25 '16 at 13:48
AntoineAntoine
1507
Create and run the following PowerShell script:
# Enables TLS 1.2 on Windows Server 2008 R2 and Windows 7
# These keys do not exist so they need to be created prior to setting values.
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server"
md "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client"
# Enable TLS 1.2 for client and server SCHANNEL communications
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server" -name "Enabled" -value 1 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord"
new-itemproperty -path "HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client" -name "Enabled" -value 1 -PropertyType "DWord"
answered Oct 25 '16 at 13:48
AntoineAntoine
1507
answered Oct 25 '16 at 13:48
AntoineAntoine
1507
answered Oct 25 '16 at 13:48
AntoineAntoine
1507
answered Oct 25 '16 at 13:48
AntoineAntoine
1507
1507
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f811169%2ftls1-0-missing-from-windows-2008-protocols%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Try nartac.com/Products/IISCrypto. It gives you a nice interface for adjusting these settings. The "Best Practices" button is great.
– longneck
Oct 25 '16 at 13:35