Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / PowerShell / How to Enable TLS 1.2 on Windows

March 12, 2024

How to Enable TLS 1.2 on Windows

In this article, we will look at how to enable the Transport Layer Security (TLS 1.2) protocol on different Windows versions, including cases for .Net and WinHTTP applications. TLS 1.0 and TLS 1.1 are deprecated protocol versions. If you have migrated all your services to TLS 1.2 or TLS 1.3, you may disable support for legacy TLS versions on your Windows servers and clients (How to Disable TLS 1.0 and TLS 1.1 Using GPO). However, prior to doing it, make sure that all your clients support TLS 1.2.

In modern Windows versions (Windows 11/10/8.1 or Windows Server 2022/2019/2016/2012R2), TLS 1.2 is enabled by default. In previous Windows versions (Windows 7, Windows Server 2008R2/2012), you will have to configure some settings before you can enable TLS 1.2.

Windows XP and Vista do not support TLS 1.2.

For example, in order to enable TLS 1.2 in Windows 7 and Windows Server 2008 R2:

  1. Make sure that Windows 7 Service Pack 1 is installed;
  2. Download and manually install the MSU update KB3140245 from Microsoft Update Catalog (https://www.catalog.update.microsoft.com/search.aspx?q=kb3140245); Download and install KB3140245 to enable TLS 1.2
  3. Then download and install the MicrosoftEasyFix51044.msi (the patch adds the registry options allow to enable TLS 1.2 support on Windows 7/2008R2/2012);
    Without these updates, Outlook on Windows 7 will fail to connect to a modern e-mail server with an error: 0x800CCC1A – Your server does not support the connection encryption type you have specified. In addition, if you open some websites, you may see an SSL error This site can’t provide a secure connection.
  4. Restart your computer.

These registry options are described in the article Update to enable TLS 1.1 and TLS 1.2 as default secure protocols in WinHTTP in Windows (https://support.microsoft.com/en-us/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392).

The following REG_DWORD registry items will appear on your computer in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client\ and HKLM\...Protocols\TLS 1.2\Servers:

  • DisabledByDefault = 0
  • Enabled = 1

In order to use TLS 1.2 by default for WinHttp API apps, add the DefaultSecureProtocols = 0x00000A00 REG_DWORD parameter to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp (on Windows x64: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp).

Here are the possible values of DefaultSecureProtocols option which defines allowed protocols for WinHTTP connections:

  • 0x00000A0 – a default value allowing SSL 3.0 and TLS 1.0 for WinHTTP only
  • 0x0000AA0 — allows using TLS 1.1 and TLS 1.2 in addition to SSL 3.0 and TLS 1.0
  • 0x00000A00 – allows TLS 1.1 and TLS 1.2 only
  • 0x00000800 – allows TLS 1.2 only
Starting with Windows 10 and Windows Server 2016, all Windows versions support TLS 1.2 for WinHTTP.

You may use the following PowerShell script to create these registry parameters:

$reg32bWinHttp = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"
$reg64bWinHttp = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"
$regWinHttpDefault = "DefaultSecureProtocols"
$regWinHttpValue = "0x00000800"
$regTLS12Client = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"
$regTLS12Server = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server"
$regTLSDefault = "DisabledByDefault"
$regTLSValue = "0x00000000"
$regTLSEnabled = "Enabled"
$regTLSEnableValue = "0x00000001"
# for Windows x86
New-ItemProperty -Path $reg32bWinHttp -Name $regWinHttpDefault -Value $regWinHttpValue -PropertyType DWORD
# for Windows x64
New-ItemProperty -Path $reg64bWinHttp -Name $regWinHttpDefault -Value $regWinHttpValue -PropertyType DWORD
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2”
New-Item -Path $regTLS12Client
New-Item -Path $regTLS12Server
New-ItemProperty -Path $regTLS12Client -Name $regTLSDefault -Value $regTLSValue -PropertyType DWORD
New-ItemProperty -Path $regTLS12Client -Name $regTLSEnabled -Value $regTLSEnableValue -PropertyType DWORD
New-ItemProperty -Path $regTLS12Server -Name $regTLSDefault -Value $regTLSValue -PropertyType DWORD
New-ItemProperty -Path $regTLS12Server -Name $regTLSEnabled -Value $regTLSEnableValue -PropertyType DWORD

Restart your computer using the command:

Restart-Computer

How to enable TLS 1.2 on clients through the registry

Then you have to enable TLS 1.2 support for .NET Framework apps. To do this, you need to enable the system encryption protocols for .NET 3.5 and 4.x apps in the registry. If you are using old .NET Framework versions, like 4.5.1 or 4.5.2 on Windows Server 2012 R2/2012 or Windows 8.1, first install the latest updates for .Net Framework 4.5.1 (they will add TLS 1.2 support for .NET).

Find the registry option to be configured for different .Net versions below:

for .Net 3.5 or 2.0:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
"SchUseStrongCrypto"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727]
"SchUseStrongCrypto"=dword:00000001

for .Net 4.x:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001

for .Net 4.6:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001
For example, without these options, you won’t be able to connect to PSGallery repositories from your PowerShell console on Windows Server 2012 R2 with the following errors:

  • Install-Module: Unable to download from URI
  • Unable to resolve package source

The problem is that by default PowerShell tries to use TLS 1.0 to connect to PSGallery. As of April 2020, the PowerShell Gallery only accepts TLS 1.2 connections.

Also, there is a free IISCrypto tool, that allows to enable/disable various TLS/SSL versions and Schannel settings through a GUI (https://www.nartac.com/Products/IISCrypto/). Here you may select what TLS versions you want to enable. If all checkboxes next to Schannel protocols are inactive (gray out), Windows is using the default settings. In my example, I have enabled TLS 1.2 for a server and a client using the PowerShell script shown above. IISCrypto is now showing that TLS 1.2 was enabled manually.

IISCrypto doesn’t allow changing TLS settings for .NET or WinHTTP.

Enable and Disable TLS 1.2 on Windows Server with IISCrypto

On Windows Server 2022, TLS 1.3 must be enabled to support HTTP/3 for IIS websites.
1 comment
7
Facebook Twitter Google + Pinterest
PowerShellWindows 10Windows Server 2019
previous post
Fix: Windows Needs Your Current Credentials Pop-up Message
next post
How to Stop Automatic Upgrade to Windows 11

Related Reading

Wi-Fi (Internet) Disconnects After Sleep or Hibernation on...

March 15, 2024

Fix: Remote Desktop Licensing Mode is not Configured

August 24, 2023

How to Install Remote Server Administration Tools (RSAT)...

March 17, 2024

How to Find the Source of Account Lockouts...

March 12, 2024

Managing Windows Firewall Rules with PowerShell

March 11, 2024

How to Delete Old User Profiles in Windows

March 15, 2024

Install and Manage Windows Updates with PowerShell (PSWindowsUpdate)

March 17, 2024

How to Backup and Restore Websites and IIS...

June 8, 2023

1 comment

Kristi Smith November 29, 2023 - 12:47 pm

thank you. I have been fighting with this for over 6 months

Reply

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025
  • AD Domain Join: Computer Account Re-use Blocked

    March 11, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • Install and Manage Windows Updates with PowerShell (PSWindowsUpdate)
  • Fix: Remote Desktop Licensing Mode is not Configured
  • How to Delete Old User Profiles in Windows
  • Configuring Port Forwarding in Windows
  • How to Install Remote Server Administration Tools (RSAT) on Windows
  • Start Menu or Taskbar Search Not Working in Windows 10/11
  • Adding Drivers into VMWare ESXi Installation Image
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top