Microsoft's edit · TLS registry settings

33 description: Learn about supported registry setting information for the Windows implementation of the Transport Layer Security (TLS) protocol.

44 ms.topic: how-to

55 ms.date: 08/19/2024

6 +ms.topic: article

7 +author: meaghanlewis

8 +ms.author: mosagie

9 +ms.date: 04/18/2025

610 ---

711

812 # Transport Layer Security (TLS) registry settings

913

10 −>

11 −

12 −This article explains the supported registry setting information for the Windows implementation of the Transport Layer Security (TLS) protocol and the Secure Sockets Layer (SSL) protocol through the SChannel Security Support Provider (SSP). The registry subkeys and entries covered in this article help you administer and troubleshoot the SChannel SSP, specifically the TLS and SSL protocols.

14 +This article explains the supported registry setting information for the Windows implementation of the Transport Layer Security (TLS) protocol and the Secure Sockets Layer (SSL) protocol through the Schannel Security Support Provider (SSP). The registry subkeys and entries covered in this article help you administer and troubleshoot the Schannel SSP, specifically the TLS and SSL protocols.

1315

1416 > [!CAUTION]

15 −> This information is provided as a reference to use when you are troubleshooting or verifying that the required settings are applied. We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC). If you must edit the registry, use extreme caution.

17 +> This information is provided as a reference to use when you're troubleshooting or verifying that the required settings are applied. We recommend that you don't directly edit the registry unless there's no other alternative. Modifications to the registry aren't validated by the Registry Editor or by the Windows operating system before they're applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC). If you must edit the registry, use extreme caution.

1618

17 −## SChannel logging

19 +## Schannel logging

1820

19 −There are eight logging levels for SChannel events saved to the system event log and viewable using Event Viewer. This registry path is stored in `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL` under the **EventLogging** key with a DWORD value set to *1*.

21 +There are eight logging levels for Schannel events saved to the system event log and viewable using Event Viewer. This registry path is stored in `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL` under the **EventLogging** key with a DWORD value set to *1*.

2022

21 −| Decimal or Hex | SChannel logging events |

23 +| Decimal or Hex | Schannel logging events |

2224 |---|---|

2325 |0|No events|

2426 |1|Error events|

3032 |7|Error, Warning, Informational, and Success events|

3133

3234 > [!NOTE]

33 −> You must reboot your device after changing the SChannel logging level.

35 +> You must reboot your device after changing the logging level.

3436

3537 ## CertificateMappingMethods

3638

37 −When a server application requires client authentication, SChannel automatically attempts to map the certificate that is supplied by the client computer to a user account. You can authenticate users who sign in with a client certificate by creating mappings, which relate the certificate information to a Windows user account.

39 +When a server application requires client authentication, Schannel automatically attempts to map the certificate that is supplied by the client computer to a user account. You can authenticate users who sign in with a client certificate by creating mappings, which relate the certificate information to a Windows user account.

3840

3941 After you create and enable a certificate mapping, each time a client presents a client certificate, your server application automatically associates that user with the appropriate Windows user account.

4042

4345 - A single certificate is mapped to a single user account (one-to-one mapping).

4446 - Multiple certificates are mapped to one user account (many-to-one mapping).

4547

46 −The SChannel provider uses four certificate mapping methods:

48 +The Schannel provider uses four certificate mapping methods:

4749

4850 1. Kerberos service-for-user (S4U) mapping (enabled by default)

4951 1. User principal name mapping

6062 |S4U2Self|0x000000008|Yes|

6163 |S4U2Self Explicit|0x000000010|Yes|

6264

63 −Applicable versions: As designated in the **Applies to** list at the beginning of this article.

64 −

6565 ## Ciphers

6666

67 −TLS/SSL ciphers should be controlled by configuring the cipher suite order. For details, see [Configuring TLS Cipher Suite Order](manage-tls.md#configuring-tls-cipher-suite-order).

67 +TLS/SSL ciphers should be controlled by configuring the cipher suite order. For details, see [Configuring TLS Cipher Suite Order](manage-tls.md#configure-tls-cipher-suite-order).

6868

69 −For information about default cipher suite orders that are used by the SChannel SSP, see [Cipher Suites in TLS/SSL (SChannel SSP)](/windows/win32/secauthn/cipher-suites-in-schannel).

69 +For information about default cipher suite orders that are used by the Schannel SSP, see [Cipher Suites in TLS/SSL (Schannel SSP)](/windows/win32/secauthn/cipher-suites-in-schannel).

7070

7171 ## CipherSuites

7272

73 −Configuring TLS/SSL cipher suites should be done using group policy, MDM, or PowerShell, see [Configuring TLS Cipher Suite Order](manage-tls.md#configuring-tls-cipher-suite-order) for details.

73 +Configuring TLS/SSL cipher suites should be done using group policy, MDM, or PowerShell, see [Configuring TLS Cipher Suite Order](manage-tls.md#configure-tls-cipher-suite-order) for details.

7474

75 −For information about default cipher suite orders that are used by the SChannel SSP, see [Cipher Suites in TLS/SSL (SChannel SSP)](/windows/win32/secauthn/cipher-suites-in-schannel).

75 +For information about default cipher suite orders that are used by the Schannel SSP, see [Cipher Suites in TLS/SSL (Schannel SSP)](/windows/win32/secauthn/cipher-suites-in-Schannel).

7676

7777 ## ClientCacheTime

7878

7979 This entry specifies client TLS session cache item lifetime in milliseconds. Beginning with Windows Server 2008 and Windows Vista the default is 10 hours. A value of *0* turns off TLS session caching on the client.

8080

81 −The first time a client connects to a server through the SChannel SSP, a full TLS/SSL handshake is performed. When complete, the master secret, cipher suite, and certificates are stored in the session cache on the respective client and server.

81 +The first time a client connects to a server through the Schannel SSP, a full TLS/SSL handshake is performed. When complete, the master secret, cipher suite, and certificates are stored in the session cache on the respective client and server.

8282

8383 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

8484

9595

9696 In this case, the server hello response during the TLS handshake doesn't include an OCSP stapled status by default. This behavior improves performance: The Windows OCSP stapling implementation scales to hundreds of server certificates. However, Server Name Indication (SNI) and Central Certificate Store (CCS) enable IIS to scale to thousands of websites that potentially have thousands of server certificates, therefore enabling OCSP stapling for CCS bindings might cause performance issues.

9797

98 −Applicable versions: All versions beginning with Windows Server 2012 and Windows 8.

99 −

10098 Registry path: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

10199

102100 Add the following key:

112110

113111 ## Hashes

114112

115 −TLS/SSL hash algorithms should be controlled by configuring the cipher suite order. See [Configuring TLS Cipher Suite Order](manage-tls.md#configuring-tls-cipher-suite-order) for details.

113 +TLS/SSL hash algorithms should be controlled by configuring the cipher suite order. See [Configuring TLS cipher suite order](manage-tls.md#configure-tls-cipher-suite-order) for details.

116114

117115 ## IssuerCacheSize

118116

119 −This entry controls the size of the issuer cache, and it's used with issuer mapping. The SChannel SSP attempts to map all of the issuers in the client's certificate chain, not just the direct issuer of the client certificate. When the issuers don't map to an account, which is the typical case, the server might attempt to map the same issuer name repeatedly, hundreds of times per second.

120 −

121 −To prevent this, the server has a negative cache, so if an issuer name doesn't map to an account, it's added to the cache and the SChannel SSP doesn't attempt to map the issuer name again until the cache entry expires. This registry entry specifies the cache size. This entry doesn't exist in the registry by default. The default value is *100*.

117 +This entry controls the size of the issuer cache, and it's used with issuer mapping. The Schannel SSP attempts to map all of the issuers in the client's certificate chain, not just the direct issuer of the client certificate. When the issuers don't map to an account, which is the typical case, the server might attempt to map the same issuer name repeatedly, hundreds of times per second.

122118

123 −Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.

119 +To prevent this, the server has a negative cache, so if an issuer name doesn't map to an account, it's added to the cache and the Schannel SSP doesn't attempt to map the issuer name again until the cache entry expires. This registry entry specifies the cache size. This entry doesn't exist in the registry by default. The default value is *100*.

124120

125121 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

126122

127123 ## IssuerCacheTime

128124

129 −This entry controls the length of the cache timeout interval in milliseconds. The SChannel SSP attempts to map all of the issuers in the client's certificate chain, not just the direct issuer of the client certificate. In the case where the issuers don't map to an account, which is the typical case, the server might attempt to map the same issuer name repeatedly, hundreds of times per second.

130 −

131 −To prevent this, the server has a negative cache, so if an issuer name doesn't map to an account, it's added to the cache and the SChannel SSP doesn't attempt to map the issuer name again until the cache entry expires. This cache is kept for performance reasons, so that the system doesn't continue trying to map the same issuers. This entry doesn't exist in the registry by default. The default value is 10 minutes.

125 +This entry controls the length of the cache time-out interval in milliseconds. The Schannel SSP attempts to map all of the issuers in the client's certificate chain, not just the direct issuer of the client certificate. In the case where the issuers don't map to an account, which is the typical case, the server might attempt to map the same issuer name repeatedly, hundreds of times per second.

132126

133 −Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.

127 +To prevent this, the server has a negative cache, so if an issuer name doesn't map to an account, it's added to the cache and the Schannel SSP doesn't attempt to map the issuer name again until the cache entry expires. This cache is kept for performance reasons, so that the system doesn't continue trying to map the same issuers. This entry doesn't exist in the registry by default. The default value is 10 minutes.

134128

135129 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

136130

137131 ## KeyExchangeAlgorithm key sizes

138132

139 −These following entries might not exist in the registry by default and must be manually created. Use of key exchange algorithms should be controlled by configuring the cipher suite order. To learn more about TLS/SSL cipher suite cryptographic algorithms, see [Cipher Suites in TLS/SSL (SChannel SSP)](/windows/win32/secauthn/cipher-suites-in-schannel).

133 +These following entries might not exist in the registry by default and must be manually created. Use of key exchange algorithms should be controlled by configuring the cipher suite order. To learn more about TLS/SSL cipher suite cryptographic algorithms, see [Cipher suites in TLS/SSL (Schannel SSP)](/windows/win32/secauthn/cipher-suites-in-schannel).

140134

141135 # [Diffie-Hellman](#tab/diffie-hellman)

142136

157151 ---

158152

159153 > [!NOTE]

160 −> Configured elliptic curves determine the cryptographic strength of the ECDHE key exchange. For more information, see [Manage Transport Layer Security (TLS)](manage-tls.md#configuring-tls-ecc-curve-order).

154 +> Configured elliptic curves determine the cryptographic strength of the ECDHE key exchange. For more information, see [Manage Transport Layer Security (TLS)](manage-tls.md#configure-tls-ecc-curve-order).

161155

162156 ## MaximumCacheSize

163157

164 −This entry controls the maximum number of TLS sessions to cache. Setting MaximumCacheSize to `0` disables the

165 −server-side session cache to prevent session resumption. Increasing MaximumCacheSize above the

166 −default values causes Lsass.exe to consume extra memory. Each session-cache element typically

158 +This entry controls the maximum number of TLS sessions to cache. Setting MaximumCacheSize to `0` disables the server-side session cache to prevent session resumption. Increasing MaximumCacheSize above the default values causes Lsass.exe to consume extra memory. Each session-cache element typically

167159 requires 2 KB to 4 KB of memory. This entry doesn't exist in the registry by default. The default

168160 value is 20,000 elements.

169161

170 −Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.

171 −

172162 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

173163

174164 ## Messaging – fragment parsing

191181

192182 ## SendTrustedIssuerList

193183

194 −TLS servers might send a list of the distinguished names of acceptable certificate authorities when requesting client authentication. This can help TLS clients select an appropriate TLS client certificate. SChannel-based TLS servers don't send this trusted issuer list by default because it exposes the certificate authorities trusted by the server to passive observers and also increases the amount of data exchanged in the course of the TLS handshake. Setting this value to *1* causes SChannel-based servers to send their lists of trusted issuers.

184 +TLS servers might send a list of the distinguished names of acceptable certificate authorities when requesting client authentication. This can help TLS clients select an appropriate TLS client certificate. Schannel-based TLS servers don't send this trusted issuer list by default because it exposes the certificate authorities trusted by the server to passive observers and also increases the amount of data exchanged in the course of the TLS handshake. Setting this value to *1* causes Schannel-based servers to send their lists of trusted issuers.

195185

196186 Not sending a list of trusted issuers might affect what the client sends when it's asked for a client certificate. For example, when Microsoft Edge receives a request for client authentication, it only displays the client certificates that chain up to one of the certification authorities that's sent by the server. If the server didn't send a list, Microsoft Edge displays all of the client certificates that are installed on the client.

197187

202192 | Windows version | Default behavior |

203193 |-----------------|------|

204194 | Windows Server 2012, Windows 8, and later | FALSE |

205 −| Windows Server 2008 R2, Windows 7, and earlier | TRUE |

206195

207 −Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.

208 −

209196 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

210197

211198 ## ServerCacheTime

212199

213200 This entry specifies server TLS session cache item lifetime in milliseconds. The default is 10 hours. A value of *0* turns off TLS session caching on the server and prevents session resumption. Increasing ServerCacheTime above the default values causes Lsass.exe to consume additional memory. Each session cache element typically requires 2 KB to 4 KB of memory. This entry doesn't exist in the registry by default.

214201

215 −Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.

216 −

217202 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

218203

219204 Default server cache time: 10 hours

224209

225210 A supported (D)TLS or SSL protocol version can exist in one of the following states:

226211

227 −- **Enabled**: Unless the SSPI caller explicitly disables this protocol version using [SCH_CREDENTIALS](/windows/win32/api/schannel/ns-schannel-sch_credentials) structure, SChannel SSP might negotiate this protocol version with a supporting peer.

228 −- **Disabled**: SChannel SSP doesn't negotiate this protocol version regardless of the settings the SSPI caller might specify.

212 +- **Enabled**: Unless the SSPI caller explicitly disables this protocol version using [SCH_CREDENTIALS](/windows/win32/api/schannel/ns-schannel-sch_credentials) structure, Schannel SSP might negotiate this protocol version with a supporting peer.

213 +- **Disabled**: Schannel SSP doesn't negotiate this protocol version regardless of the settings the SSPI caller might specify.

229214

230215 These registry values are configured separately for the protocol client and server roles under the registry subkeys named using the following format:

231216

247232

248233 The following example shows TLS 1.0 client set to the **Enabled** state:

249234

250 −:::image type="content" source="images/tls-10-client-enabled.png" alt-text="Screenshot of Set TLS 1.0 client-side to enabled in Windows Server registry setting.":::

235 +:::image type="content" source="images/tls-10-client-enabled.png" alt-text="Screenshot of Set TLS 1.0 client-side to be enabled in Windows Server registry setting.":::

251236

252237 In order to override a system default and set a supported (D)TLS or SSL protocol version to the `Disabled` state, change the DWORD registry value of `Enabled` to "**0**" under the corresponding version-specific subkey.

253238

254239 The following example shows DTLS 1.2 disabled in the registry:

255240

256 −:::image type="content" source="images/dtls-12-server-disabled.png" alt-text="Screenshot of Windows Server registry setting for DTLS 1.2 set to disabled by default.":::

241 +:::image type="content" source="images/dtls-12-server-disabled.png" alt-text="Screenshot of Windows Server registry setting for DTLS 1.2 set to be disabled by default.":::

257242

258243 Switching a (D)TLS or SSL protocol version to `Disabled` state might cause [AcquireCredentialsHandle](/windows/win32/secauthn/acquirecredentialshandle--schannel) calls to fail due to the lack of protocol versions enabled system-wide and at the same time allowed by particular SSPI callers. In addition, reducing the set of `Enabled` (D)TLS and SSL versions could break interoperability with remote peers.

259244

260245 Once the (D)TLS or SSL protocol version settings are modified, they take effect on connections established using credential handles opened by subsequent [AcquireCredentialsHandle](/windows/win32/secauthn/acquirecredentialshandle--schannel) calls. (D)TLS and SSL client and server applications and services tend to reuse credential handles for multiple connections, for performance reasons. In order to get these applications to reacquire their credential handles, an application, or service restart might be required.

261246

262 −These registry settings only apply to SChannel SSP and don't affect any third-party (D)TLS and SSL implementations that might be installed on the system.

247 +These registry settings only apply to Schannel SSP and don't affect any third-party (D)TLS and SSL implementations that might be installed on the system.

263248

264249 > [!WARNING]

265 −> Attempting to create or adjust any SChannel registry settings that are not explicitly detailed in this article isn't recommended due to potential risks and unintended consequences that may arise from unsupported configurations.

250 +> Attempting to create or adjust any Schannel registry settings that aren't explicitly detailed in this article isn't recommended due to potential risks and unintended consequences that may arise from unsupported configurations.

266251

267 −To learn about managing the TLS cipher suite using PowerShell, see [TLS command reference](/powershell/module/tls). If interested in managing TLS settings via Group Policy, see [Configuring TLS Cipher Suite Order by using Group Policy](/windows-server/security/tls/manage-tls#configuring-tls-cipher-suite-order-by-using-group-policy).

252 +To learn about managing the TLS cipher suite using PowerShell, see [TLS command reference](/powershell/module/tls). If interested in managing TLS settings via Group Policy, see [Configure TLS cipher suite order by using Group Policy](/windows-server/security/tls/manage-tls#configure-tls-cipher-suite-order-by-using-group-policy).

TLS registry settings

Microsoft's edit · 25 Apr 2025 17:10 UTC