Selectively disabling TLS 1.3 for HTTPS connections

Question

I enabled TLS 1.3 on a Windows Server, but now some outbound HTTPS connections are failing when they pass through an older deep-packet-inspection firewall. I need to keep TLS 1.3 enabled for most connections, but disable it for specific target endpoints that are having issues. Is there a registry policy setting that lets me disable TLS 1.3 only for those specific endpoints, or do I need to disable TLS 1.3 entirely on the server ?

Answer 1

Hello @QuekRyan

There isn't a supported Schannel registry or Group Policy setting that disables TLS 1.3 only for specific destination hostnames/IPs. The Windows Schannel protocol registry settings are system-wide for the Client or Server role; they aren't endpoint-specific.

For example, disabling TLS 1.3 for outbound Schannel connections through:

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client

with:

Enabled = 0

would affect applications using Schannel on that Windows server, not just connections to selected HTTPS destinations. Microsoft also cautions against creating undocumented Schannel registry settings.

In your situation, I wouldn't disable TLS 1.3 globally just to accommodate the older DPI firewall. Better options would be:

1. Create a TLS-inspection bypass/exclusion on the firewall for the affected destinations. This is usually the cleanest solution if the firewall's TLS inspection implementation is causing the TLS 1.3 handshake failure.
2. Update the firewall/software to a version that properly supports TLS 1.3 inspection.
3. If you control the application making the HTTPS request, configure that application or its TLS stack to use TLS 1.2 for those specific connections. Windows lets an SSPI caller restrict the TLS versions it requests while leaving the operating system defaults intact.
4. As a temporary diagnostic test, you could disable TLS 1.3 client-side globally and verify whether the affected destinations start working immediately. I wouldn't use this as the permanent solution unless absolutely necessary.

Also note that Schannel supports TLS 1.3 starting with Windows 11 and Windows Server 2022.

So, if these connections work with TLS 1.2 but fail only when TLS 1.3 passes through the DPI device, I'd focus troubleshooting on the inspection/proxy layer rather than changing Windows globally.

Sharing this reference with you: Microsoft - TLS registry settings

Please "Accept the Answer" if this information helped you. This will help us and others in the community.