Share via

No TLS 1.2 support on fresh Windows 11 24H2

Anonymous
2025-03-19T13:20:19+00:00

I have used the official mediacreation tool to create an usb stick and installed Windows 11 24H2. I notice TLS 1.2 support is completely lacking. The registry entries are simply not there. This causes SSL handshake failures in outlook with some mailservers.

How do I install TLS 1.2 on the operating system level, most guides are aimed towards browsers.

Windows for home | Windows 11 | Internet and connectivity

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

11 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2025-05-07T18:30:01+00:00

    You dont need registry keys, Windows 11 24H2 has TLS 1.2 and 1.3 built in by default. You dont need to install or change anything.

    Protocols in TLS/SSL (Schannel SSP) - Win32 apps | Microsoft Learn

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2025-04-09T12:37:36+00:00

    I have traced the issue to not being able to connect to exim on ipv6 (because this server does not support ipv6 on exim). Apparently the other mail clients fallback on ipv4 and outlook classic does not. Disabling ipv6 from my ethernet adapter fixed the issue. I have asked for ipv6 support to be added to the server.

    Seems like a bug in outlook classic in combination with an incorrect error description. It probably does not account for IMAP (dovecot) working on ipv6 whilst the smtp server does not.

    1 person found this answer helpful.
    0 comments
  3. Siva Shankar 10,960 Reputation points
    2025-03-19T14:16:19+00:00

    Hello ,

    I’m here to help you in resolving your issue

    A fresh install of Windows 11 24H2 should have TLS 1.2 enabled by default, but since it’s missing, you’ll need to manually enable it via the registry and system settings.

    1: Open Notepad and paste the following text:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]

    "Enabled"=dword:00000001

    "DisabledByDefault"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]

    "Enabled"=dword:00000001

    "DisabledByDefault"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]

    "Enabled"=dword:00000001

    "DisabledByDefault"=dword:00000000

    2: Save the file as Enable_TLS12.reg.

    3: Double-click the file and confirm adding it to the registry.

    4: Restart your PC and check if the issue got resolved.

    After trying above steps, please reach out to me if you have any doubts or issues

    Help others by sharing your experience! Click “Yes” if this solution worked for you or “No” if it didn’t.

    1 person found this answer helpful.
    0 comments
  4. Siva Shankar 10,960 Reputation points
    2025-03-19T19:25:01+00:00

    Thanks for the reply.

    Ensure that your Outlook is configured to use TLS 1.2 correctly. Double-check the following:

    1: Outgoing Mail Server (SMTP): Make sure it is set to SMTP over SSL and using port 465 (or the appropriate port).

    2: Ensure that TLS 1.2 is selected as the encryption method in Outlook. Some email servers require specific settings for encryption methods, so verify those settings in your Account Settings.

    Verify SSL/TLS Support in Windows

    1: Open Internet Options (press Win + R, type inetcpl.cpl, and press Enter).

    2: Go to the Advanced tab and scroll down to Security.

    3: Make sure that TLS 1.2 is checked (enabled). If it's unchecked, enable it and click OK to apply the changes.

    Please try this and let me know

    0 comments
  5. Anonymous
    2025-03-19T18:43:23+00:00

    Hi thanks. Unfortunately I am still getting an error. I thought it was identical however upon further inspection it now specifically refers to the outgoing server using the chosen encryption method. I double checked but the working pc with Win 11 24H2 also uses port 465 and SSL and the same servername so this should be working. On my Android device it's also working just fine.

    0 comments