Refer to for the official documentation of the registry values that governs the SSL/TLS settings in the windows registry.Īfter you have finished the setting the following registry keys, restart the Windows machine (not just the IIS).This is an excellent PowerShell script if you want to test which SSL and TLS protocols are enabled on your webserver. This depends on your environment and on the supported clients.

The problem with disabling SSL v3.0, and moreover TLS1.0 and TLS 1.1, is the resultant compatibility issues with older clients. TLS 1.2 is considered secure at the moment, without any known vulnerabilities. PCI DSS states that starting June 30 2016, SSL and TLS 1.0 are no longer to be used (PCI DSS Version 3.0 to 3.1). For example, it is vulnerable to the BEAST attack with some cipher suites. It also does not support all modern cipher suites that are supported by later versions. TLS 1.0 is very common and can be made relatively secure, but it requires configuration and in-depth understanding of the environment to work securely with all cipher suites. It is vulnerable to the POODLE attack and can force a downgrade of the protocol, if used).ĭisabling SSL v3.0 will break older clients such as Windows XP and or IE6/7. If possible, disable SSL v3.0 as it is considered insecure in some cases. The following guidelines are basic for SSL/TLS hardening:Īlways apply the latest software updates (Windows), since some vulnerabilities are implementation bugs.ĭisable SSL v2.0, since it is considered to be broken (see RFC6176). Some recommended references about securing SSL/TLS are: It is important to keep up to date with the latest recommendations and make changes to your server configuration as things evolve.

For example, older clients such as Windows XP, Server 2003, and also Vista and Server 2008 (not R2) will not support TLS 1.2 and 1.1, which are considered to be the most secure protocols to date. Sometimes, it is a matter of security vs.

IMPORTANT: It is important to understand that things are dynamic, and that best practices change as time progresses and new vulnerabilities are found. Among other settings, the different protocols and cipher suites can be vulnerable to different attacks on SSL/TLS. It is important to keep your server SSL/TLS settings up to date. This step is performed automatically using the PowerShell script.

Test tls 1.2 connection