Zum Hauptinhalt gehen
English (GB) Français Nederlands
Anfrage einreichen

Transport Layer Security (TLS) Best Practices

Payal Arya
  • Aktualisiert

Scenario

For Exclaimer products to utilize the most up-to-date security protocols, it is necessary for the computer's Transport Layer Security (TLS) protocols to be configured manually.

Resolution

WARNING! Windows Registry modifications should always be approached with extreme care - serious problems can occur if you modify the Windows registry incorrectly!

We strongly advise you to back up the Windows registry before any modifications are made - in doing so, you will have the option to restore the backup if a problem occurs.

For more information, see How to back up and restore the registry in Windows.

Here we recommend the steps that need to be completed - please click on the required options listed below to go through the detailed description:

Step1: Ensure Windows is up-to-date

The best practices in this article depend on recent security updates being installed.
Please ensure that all Windows updates have been installed.

For more information, see Exchange Server TLS guidance, part 1: Getting Ready for TLS 1.2

 

Step 2: Enable TLS 1.2
  1. From Notepad.exe, create a text file and name it TLS12-Enable.reg.

  2. Copy then paste the following text:

    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
    "DisabledByDefault"=dword:00000000
    "Enabled"=dword:00000001
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
    "DisabledByDefault"=dword:00000000
    "Enabled"=dword:00000001

  3. Save the TLS12-Enable.reg file.

  4. Double-click the TLS12-Enable.reg file.

  5. Click Yes to update your Windows Registry with these changes.

Step 3: Disable TLS 1.0 and 1.1
  1. From Notepad.exe, create a text file and name it TLS1011-Disable.reg

  2. Copy then paste the following text:

    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
    "DisabledByDefault"=dword:00000001
    "Enabled"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
    "DisabledByDefault"=dword:00000001
    "Enabled"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]
    "DisabledByDefault"=dword:00000001
    "Enabled"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
    "DisabledByDefault"=dword:00000001
    "Enabled"=dword:00000000

  3. Save the TLS1011-Disable.reg file.

  4. Double-click the TLS1011-Disable.reg file.

  5. Click Yes to update your Windows Registry with these changes.

Step 4: Configure .NET Security Settings
  1. From Notepad.exe, create a text file and name it NET-UseSchannelDefaults.reg

  2. Copy then paste the following text:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727]
    "SystemDefaultTlsVersions"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319]
    "SystemDefaultTlsVersions"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
    "SystemDefaultTlsVersions"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
    "SystemDefaultTlsVersions"=dword:00000001

  3. Save the NET-UseSchannelDefaults.reg file.

  4. Double-click the NET-UseSchannelDefaults.reg file.

  5. Click Yes to update your Windows Registry with these changes.

  6. Restart your computer for the change to take effect.