Schannel 36871 and 36874 error on TLS

Question

Schannel 36871 and 36874 error on TLS

Anonymous

Hi,

We found all of our Windows server 2022 have many Schannel 36871 and 36874 error in event log. Both of them are related to TLS.

Error ID 36871:

A fatal error occurred while creating a TLS client credential. The internal error state is 10013.

The SSPI client process is SYSTEM (PID: 4).

Error ID 36874:

An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The TLS connection request has failed.

In client machine, we already enable the TLS 1.2 in "internet properties"

Event ID 36871,Schannel - Repeating TLS Error 10016, DistributedCOM - Microsoft Community

In Server side, we tried to add the registry as below and restart the server. But the error still exist.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server”.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client”.

DisabledbyDefault = 0

Enabled =1

All machine are installed latest patch from windows update already. Any idea?

Best Regards

Andy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Hello,

Here are some steps to troubleshoot these errors:

Check that the cipher suites supported by the client are also enabled on the Windows Server 2022 server side. You can use third-party tools such as "IIS Cryptography" to check and configure the cipher suites available on the Windows server. Also, check for updates to the cipher suites.
Make sure the server uses the latest Windows updates. Also, check if the server has a valid and trusted TLS certificate installed. Run certlm.msc to open the local computer certificate store. In the Certificate Manager window, navigate to the Personal -> Certificates folder.
A user reported that this error occurred after disabling old cryptography such as SSL 2 and TLS 1.1. His solution was to Configure .NET Framework to support strong cryptography. For more information, see: How to enable Transport Layer Security (TLS) 1.2 on clients - Configuration Manager | Microsoft Learn

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft.NETFramework\v2.0.50727]

  *"SystemDefaultTlsVersions" = dword:00000001* 

  *"SchUseStrongCrypto" = dword:00000001*

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft.NETFramework\v4.0.30319]

  *"SystemDefaultTlsVersions" = dword:00000001* 

  *"SchUseStrongCrypto" = dword:00000001*

Note: Serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For further protection, back up the registry before you modify it. For more information about how to back up and restore the registry, refer to How to back up and restore the registry in Windows - Microsoft Support

References:

Transport Layer Security (TLS) registry settings | Microsoft Learn

Windows 10 Event ID 36871, source Schannel... - Windows - Spiceworks Community (Note: Since the websites are not hosted by Microsoft, the links may change without notice. Microsoft does not guarantee the accuracy of this information)

I hope this helps.

Best regards

0 comments

2 additional answers

Answer 1

Dear MS support,

I have similar problem. My platform is " MS Windows Server 2019 Standard" . I have just installed MS patches of 2024 Apr- Jun.

After restarting server, In event viewer (system tab), I found many error "Schannel ... 36871". The details messages are : "a fatal error occurred while creating a TLS client credentials. The internal error state is 10010."

The error occurred repeatedly in event viewer even I have uninstalled the MS patch (2024 Apr - Jun) and I have added the registry mentioned here. Would any experts help me?

Many thanks

Gordon

Answer 2

Anonymous

If you have any confusion about this issue in the future, please let us know.

0 comments