How do I enable or disable TLS in Windows Server?

July 2024 · 6 minute read

XINSTALL BY CLICKING THE DOWNLOAD FILE

To fix various PC problems, we recommend DriverFix:
This software will keep your drivers up and running, thus keeping you safe from common computer errors and hardware failure. Check all your drivers now in 3 easy steps:
  • Download DriverFix (verified download file).
  • Click Start Scan to find all problematic drivers.
  • Click Update Drivers to get new versions and avoid system malfunctionings.

    • If you were wondering how to enable or disable TLS (Transport Layer Security) on Windows Server, you are at the right place.

    Transport Layer Security 1.0 hasn’t been supported for a while, so what you also want to do, besides enabling the latest TLS 1.2, is disabling the older version as well.

    For security reasons, it’s necessary to have the latest security protocol on your Windows Server and not the outdated version that has vulnerabilities.

    Therefore, in this guide, we’re going to show you how to properly enable and disable TLS.

    How does TLS work?

    TLS is a cryptographic protocol that encrypts the data between the client and a web server, thus protecting it from being viewed by a third party.

    Expert Tip: Some PC issues are hard to tackle, especially when it comes to corrupted repositories or missing Windows files. If you are having troubles fixing an error, your system may be partially broken. We recommend installing Restoro, a tool that will scan your machine and identify what the fault is.
    Click here to download and start repairing.

    It also provides you with authentication and integrity protection, ensuring that the data and both the server and client are genuine.

    There are four versions of TLS available, with the latest and safest one being 1.3, so be sure to use it along with reliable antivirus for Windows Server for maximum protection.

    How do I enable TLS 1.0 on Windows Server?

    Note icon
    NOTE

    TLS 1.0 is considered unsafe. If possible, use the 1.2 or newer version instead.

  • Press Windows key + R and enter regedit. Now press Enter.
  • Navigate to the following key: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
  • Right-click the right pane, expand the New section and select Key.
  • Name the new key TLS 1.0 and move to it.
  • Create a new key called Client and move to it.
  • Now right click the right pane, and select DWORD (32-bit) Value from the New menu.
  • Name the new DWORD Enabled and double-click it to open its properties.
  • Set the Value data to 1 and click OK to save changes.

    • How can I enable TLS on Windows Server?

    1. Enable TLS 1.2 on Windows Server by modifying the registry

  • If you are running Windows Server 2008, check this Microsoft’s article regarding the necessary update in order to enable TLS 1.2. Once you’ve installed updates, move to the steps below.
  • Open Registry Editor by pressing Windows key + R and entering regedit.
  • Since we are dealing with registry, we strongly suggest backing up the current registry state. Incorrect changes to the registry might have detrimental effects on your system.
  • Once we’ve dealt with that, follow this path:
    Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
  • Right-click on the empty space in the right pane and choose New and then Key.
  • Name the new key TLS 1.2 and click to expand it.
  • Navigate to TLS 1.2, click on the empty space in the right pane and add two new keys. Name the first one Client and the second one Server. It should look like this.
  • Now, select the Client key, right-click in the right pane and select New and then DWORD (32-bit) Value.
  • Name the DWORD DisabledByDefault, and double-click it.
  • Ensure that the Base is Hexadecimal and the value is 0 (zero).
  • Create a new DWORD and name it Enabled and double-click it.
  • Ensure that the Base is, again, Hexadecimal and the Value is set to 1.
  • Repeat this for the Server key with the exactly the same DWORDS and values.
  • Close the Registry Editor and reboot your server.
  • If you want to revert back to the initial settings, just restore the Registry state from the backup.

    • To avoid any unplanned issues, it might be a good idea to use reliable backup software for Windows Server.

    2. Enable TLS 1.2 with Powershell on Windows Server

  • Press Windows key + X and select Windows PowerShell (Admin) from the menu.
  • When PowerShell opens, run the following commands:
    New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force
    New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force
    New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -name 'Enabled' -value '1' –PropertyType 'DWORD'
    New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -name 'DisabledByDefault' -value '0' –PropertyType 'DWORD'
    New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -name 'Enabled' -value '1' –PropertyType 'DWORD'
    New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -name 'DisabledByDefault' -value '0' –PropertyType 'DWORD'

    • 3. Disable TLS 1.0 and TLS 1.1

  • Open Registry Editor. To do that, press Windows key + R and enter regedit.
  • Navigate to Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
  • Select Protocols and in the right pane, right-click the empty space. Now choose New and select DWORD (32-bit) Value.
  • Create a new key as already explained, and name it TLS 1.1. You can create the one named TLS 1.0 as well.
  • Navigate to the TLS 1.1 key and create a new key called Client. You can also create a Server key if you want
  • Navigate to the key you created, and make a new DWORD named Enabled.
  • Dobule-click the Enabled DWORD. Set its value to 0 and confirm changes.

    • Is there any tool to enable TLS 1.2 on Windows Server?

  • Download ISS Cryptio GUI.
  • Once you download the application, run it.
  • Check TLS 1.2 and click on Apply.

    • How to enable TLS 1.3 on Windows Server?

  • Make sure you’re using Windows Sever 2022.
  • Press Windows key + S and enter command prompt. Select Run as adminsitrator.
  • Run the following command:
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP\Parameters" /v EnableHttp3 /t REG_DWORD /d 1 /f

    • That’s how to enable or disable TLS on Windows Server. With those steps, TLS 1.2 is enabled and TLS 1.0 disabled with ease.

    All of these solutions require you to modify your registry, so be sure to create a backup beforehand. Also, we advise you to check our guide on how to restore Windows registry without a backup for more information.

    What method do you use to enable TLS 1.2 on Windows Server? Let us know in the comments section below.

    ncG1vNJzZmivmaOxsMPSq5ypp6Kpe6S7zGiuoqaUpMS0edKeqa%2BdomKyr63BpZxmrJyofA%3D%3D