Windows Server 2019 – TLS / Cipher-settings
Versus Qualys SSL-test a normal Windows Server 2019 is capped at grade B since January 2020. The main reason for this is it’s enablement of TLS 1.0 and 1.1.
SSL 2.0 and 3.0 is disabled by default. But to disable the rather unsecure TLS-versions we’ll have to create the following registry entries:
Note – Client means, if the server is accessing another server with TLS then the server is a client. Server means, that if the server hosts a service which is open to TLS-communication, then… well.. it communicates with the enabled TLS-protocols, if requests.
And create both
Now under each of the nodes/keys, create the following REG_DWORD (32) entries:
DisabledByDefault = 1
Enabled = 0
And there you go. TLS 1.0 and TLS 1.1 is now disabled after the next restart.
So now you’re all set protocol-wise, but what about cipher-wise? Well, default there are apparently a lot of “weak” ciphers that you can disable – so pr. time-of-writing, this is the long string that you need to enter into SSL Cipher Suite Order in gpedit.msc -> Computer configuration -> Administrative Templates -> Network -> SSL Configuration Settings
Enable it, and paste this line:
Now you’re strong StRoNg STRONG in ciphersuites… at least at time of writing 😉 (2019-12-05 20:15)
Have fun!… and don’t forget to research securityheaders.com on your site, next 😉