Weak RSA key exchanges size despite registry key added

Question

I got a "Weak SSL/TLS Key Exchange" vulnerability in my Qulays report on a Windows 2016 server.

I manually added "ClientMinKeyBitLength" and "Server MinKeyBitLength" KEY and set them to 2048 bits in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS (I did restart it again after I created the above keys)

https://learn.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings

I re-ran the scan after restarting and I still get the same vulnerablilty despite the fact that I have manually added the above keys.

Can someone help? Thank you.

Answer 1

I've only seen the setting for ClientMinKeyBitLength and not ServerMinKeyBitLength for RSA. I believe ServerMinKeyBitLength is for DHE.