Is TLS 1.x Enabled by default on Windows Server 2012/2016/2019?

RNA 1 Reputation point
2021-10-27T19:23:33.093+00:00

Hello,

Is TLS 1.x enabled by default in Windows Server 2012/2016/2019?

If enabled, please explain how do we usually check for that?

I know that we can do that with tools like IIS Crypto but I need to check that either from the command line or from the registry.

If not enabled. Please explain how could we enable and test it?

Thanks

Internet Information Services
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,083 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bruce Zhang-MSFT 3,736 Reputation points
    2021-10-28T02:38:12.617+00:00

    Hi @RNA ,

    If you have installed the latest system patch, TLS1.0, 1.1 and 1.2 both enabled on server by default. You can get this information from Microsoft Learn.
    144306-1.jpg

    You can check it from control panel.
    144372-2.jpg
    144364-3.jpg

    If you still want to check it from the registry, it may difficult to check because the registry is more used to disable a certain TLS version. You can refer to this docs.

    In order to override a system default and set a supported (D)TLS or SSL protocol version to the Disabled by default state, create DWORD registry values named "Enabled" and "DisabledByDefault" with a non-zero value under the corresponding version-specific subkey.
    In order to override a system default and set a supported (D)TLS or SSL protocol version to the Disabled state, create a DWORD registry value named "Enabled", with a value of zero, under the corresponding version-specific subkey.

    If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Best regards,
    Bruce Zhang

    0 comments
  2. Limitless Technology 39,336 Reputation points
    2021-10-28T11:59:01.823+00:00

    Hi @RNA ,

    It is not enabled default. To enable the TLS 1.1 protocol, create an Enabled entry (in the Client or Server subkey) and change the value to 1 .

    Update to enable TLS 1.1 and TLS 1.2 as default secure protocols in WinHTTP in Windows

    https://support.microsoft.com/en-us/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392

    How to enable TLS 1.2 on clients
    https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client

    --------

    --If the reply is helpful, please Upvote and Accept it as an answer--

    0 comments