How to change modify the TLS settings and Cipher suites used for network authentication EAP-TLS on Windows?

Question

Hello,

I need to restrict ciphers used for network authentication (EAP-TLS) when connecting Windows 10/11 computers to the network.

I saw several registry key entries but not sure I am using the correct one and if they are used with EAP-TLS

Can you plese confirm:

• HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
• HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CipherSuites
• HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002

Any ideas?

Answer 1

Hello,

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CipherSuites

This key contains entries for individual cipher suites. By modifying these entries, you can enable or disable specific cipher suites.

This is the most relevant key for your purpose of restricting cipher suites used with EAP-TLS.

Modify Cipher Suite Entries:

Locate the specific cipher suite you want to enable or disable.

The cipher suite entries are named using a specific format (e.g., TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384).

Set the Enabled DWORD value to 0 to disable the cipher suite or 1 to enable it.

Restart the Computer: After making changes, restart your computer for the settings to take effect.

Noted: Disabling certain cipher suites might affect compatibility with older or less secure devices and services. Ensure that the cipher suites you enable are compatible with your network infrastructure and client devices.

Best regards

Zunhui

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.