TLS 1.2 enabled by default ?

Question

I could not find any documentation which mentions all the windows clients/server which have TLS 1.2 enabled by default.

And if it says TLS 1.2 is enabled by default (for example in windows10), does it mean even though we don't have a registry entry in 'SCHANNEL' it is enabled ?

Answer 1

Hi,

According to below two articles, TLS 1.2 is enabled by default on Windows 8/Windows Server 2012 and later vsesions.
"For TLS 1.2 default settings, see Protocols in the TLS/SSL (Schannel SSP)." While Protocols in the TLS/SSL (Schannel SSP) indicates TLS 1.2 is enabled.
https://learn.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings#tls-12
https://learn.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-

does it mean even though we don't have a registry entry in 'SCHANNEL' it is enabled?

Below article mentioned "TLS 1.2 is enabled by default. Therefore, no change to these keys is needed to enable it." So, I think the answer for your question should be "Yes".
https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client#bkmk_protocol

Hope the information helps.

Thanks,
Eleven

---

If the Answer is helpful, please click "Accept Answer" and upvote it. Thanks.