ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 23:56 UTC Customize Public modeDiscuss ChangeIntel on Discord

TLS registry settings

This page's changes and edits · All guidance changes

Microsoft's edit ·

acrolinx updates

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 6134102 · +24 −39 lines · also on GitHub

⋯ 1 unchanged line
22 title: Transport Layer Security (TLS) registry settings
33 description: Learn about supported registry setting information for the Windows implementation of the Transport Layer Security (TLS) protocol.
44 ms.topic: article
5 +author: meaghanlewis
6 +ms.author: mosagie
57 ms.date: 04/18/2025
68 ---
79
810 # Transport Layer Security (TLS) registry settings
911
10 −This article explains the supported registry setting information for the Windows implementation of the Transport Layer Security (TLS) protocol and the Secure Sockets Layer (SSL) protocol through the SChannel Security Support Provider (SSP). The registry subkeys and entries covered in this article help you administer and troubleshoot the SChannel SSP, specifically the TLS and SSL protocols.
12 +This article explains the supported registry setting information for the Windows implementation of the Transport Layer Security (TLS) protocol and the Secure Sockets Layer (SSL) protocol through the Schannel Security Support Provider (SSP). The registry subkeys and entries covered in this article help you administer and troubleshoot the Schannel SSP, specifically the TLS and SSL protocols.
1113
1214 > [!CAUTION]
13 −> This information is provided as a reference to use when you are troubleshooting or verifying that the required settings are applied. We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC). If you must edit the registry, use extreme caution.
15 +> This information is provided as a reference to use when you're troubleshooting or verifying that the required settings are applied. We recommend that you don't directly edit the registry unless there is no other alternative. Modifications to the registry aren't validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC). If you must edit the registry, use extreme caution.
1416
15 −## SChannel logging
17 +## Schannel logging
1618
17 −There are eight logging levels for SChannel events saved to the system event log and viewable using Event Viewer. This registry path is stored in `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL` under the **EventLogging** key with a DWORD value set to *1*.
19 +There are eight logging levels for Schannel events saved to the system event log and viewable using Event Viewer. This registry path is stored in `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL` under the **EventLogging** key with a DWORD value set to *1*.
1820
19 −| Decimal or Hex | SChannel logging events |
21 +| Decimal or Hex | Schannel logging events |
2022 |---|---|
2123 |0|No events|
2224 |1|Error events|
⋯ 5 unchanged lines
2830 |7|Error, Warning, Informational, and Success events|
2931
3032 > [!NOTE]
31 −> You must reboot your device after changing the SChannel logging level.
33 +> You must reboot your device after changing the logging level.
3234
3335 ## CertificateMappingMethods
3436
35 −When a server application requires client authentication, SChannel automatically attempts to map the certificate that is supplied by the client computer to a user account. You can authenticate users who sign in with a client certificate by creating mappings, which relate the certificate information to a Windows user account.
37 +When a server application requires client authentication, Schannel automatically attempts to map the certificate that is supplied by the client computer to a user account. You can authenticate users who sign in with a client certificate by creating mappings, which relate the certificate information to a Windows user account.
3638
3739 After you create and enable a certificate mapping, each time a client presents a client certificate, your server application automatically associates that user with the appropriate Windows user account.
3840
⋯ 2 unchanged lines
4143 - A single certificate is mapped to a single user account (one-to-one mapping).
4244 - Multiple certificates are mapped to one user account (many-to-one mapping).
4345
44 −The SChannel provider uses four certificate mapping methods:
46 +The Schannel provider uses four certificate mapping methods:
4547
4648 1. Kerberos service-for-user (S4U) mapping (enabled by default)
4749 1. User principal name mapping
⋯ 10 unchanged lines
5860 |S4U2Self|0x000000008|Yes|
5961 |S4U2Self Explicit|0x000000010|Yes|
6062
61 −Applicable versions: As designated in the **Applies to** list at the beginning of this article.
62 −
6363 ## Ciphers
6464
6565 TLS/SSL ciphers should be controlled by configuring the cipher suite order. For details, see [Configuring TLS Cipher Suite Order](manage-tls.md#configure-tls-cipher-suite-order).
6666
67 −For information about default cipher suite orders that are used by the SChannel SSP, see [Cipher Suites in TLS/SSL (SChannel SSP)](/windows/win32/secauthn/cipher-suites-in-schannel).
67 +For information about default cipher suite orders that are used by the Schannel SSP, see [Cipher Suites in TLS/SSL (SChannel SSP)](/windows/win32/secauthn/cipher-suites-in-schannel).
6868
6969 ## CipherSuites
7070
7171 Configuring TLS/SSL cipher suites should be done using group policy, MDM, or PowerShell, see [Configuring TLS Cipher Suite Order](manage-tls.md#configure-tls-cipher-suite-order) for details.
7272
73 −For information about default cipher suite orders that are used by the SChannel SSP, see [Cipher Suites in TLS/SSL (SChannel SSP)](/windows/win32/secauthn/cipher-suites-in-schannel).
73 +For information about default cipher suite orders that are used by the Schannel SSP, see [Cipher Suites in TLS/SSL (Schannel SSP)](/windows/win32/secauthn/cipher-suites-in-Schannel).
7474
7575 ## ClientCacheTime
7676
7777 This entry specifies client TLS session cache item lifetime in milliseconds. Beginning with Windows Server 2008 and Windows Vista the default is 10 hours. A value of *0* turns off TLS session caching on the client.
7878
79 −The first time a client connects to a server through the SChannel SSP, a full TLS/SSL handshake is performed. When complete, the master secret, cipher suite, and certificates are stored in the session cache on the respective client and server.
79 +The first time a client connects to a server through the Schannel SSP, a full TLS/SSL handshake is performed. When complete, the master secret, cipher suite, and certificates are stored in the session cache on the respective client and server.
8080
8181 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`
8282
⋯ 10 unchanged lines
9393
9494 In this case, the server hello response during the TLS handshake doesn't include an OCSP stapled status by default. This behavior improves performance: The Windows OCSP stapling implementation scales to hundreds of server certificates. However, Server Name Indication (SNI) and Central Certificate Store (CCS) enable IIS to scale to thousands of websites that potentially have thousands of server certificates, therefore enabling OCSP stapling for CCS bindings might cause performance issues.
9595
96 −Applicable versions: All versions beginning with Windows Server 2012 and Windows 8.
97 −
9896 Registry path: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`
9997
10098 Add the following key:
⋯ 13 unchanged lines
114112
115113 ## IssuerCacheSize
116114
117 −This entry controls the size of the issuer cache, and it's used with issuer mapping. The SChannel SSP attempts to map all of the issuers in the client's certificate chain, not just the direct issuer of the client certificate. When the issuers don't map to an account, which is the typical case, the server might attempt to map the same issuer name repeatedly, hundreds of times per second.
118 −
119 −To prevent this, the server has a negative cache, so if an issuer name doesn't map to an account, it's added to the cache and the SChannel SSP doesn't attempt to map the issuer name again until the cache entry expires. This registry entry specifies the cache size. This entry doesn't exist in the registry by default. The default value is *100*.
115 +This entry controls the size of the issuer cache, and it's used with issuer mapping. The Schannel SSP attempts to map all of the issuers in the client's certificate chain, not just the direct issuer of the client certificate. When the issuers don't map to an account, which is the typical case, the server might attempt to map the same issuer name repeatedly, hundreds of times per second.
120116
121 −Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.
117 +To prevent this, the server has a negative cache, so if an issuer name doesn't map to an account, it's added to the cache and the Schannel SSP doesn't attempt to map the issuer name again until the cache entry expires. This registry entry specifies the cache size. This entry doesn't exist in the registry by default. The default value is *100*.
122118
123119 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`
124120
125121 ## IssuerCacheTime
126122
127 −This entry controls the length of the cache timeout interval in milliseconds. The SChannel SSP attempts to map all of the issuers in the client's certificate chain, not just the direct issuer of the client certificate. In the case where the issuers don't map to an account, which is the typical case, the server might attempt to map the same issuer name repeatedly, hundreds of times per second.
128 −
129 −To prevent this, the server has a negative cache, so if an issuer name doesn't map to an account, it's added to the cache and the SChannel SSP doesn't attempt to map the issuer name again until the cache entry expires. This cache is kept for performance reasons, so that the system doesn't continue trying to map the same issuers. This entry doesn't exist in the registry by default. The default value is 10 minutes.
123 +This entry controls the length of the cache timeout interval in milliseconds. The Schannel SSP attempts to map all of the issuers in the client's certificate chain, not just the direct issuer of the client certificate. In the case where the issuers don't map to an account, which is the typical case, the server might attempt to map the same issuer name repeatedly, hundreds of times per second.
130124
131 −Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.
125 +To prevent this, the server has a negative cache, so if an issuer name doesn't map to an account, it's added to the cache and the Schannel SSP doesn't attempt to map the issuer name again until the cache entry expires. This cache is kept for performance reasons, so that the system doesn't continue trying to map the same issuers. This entry doesn't exist in the registry by default. The default value is 10 minutes.
132126
133127 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`
134128
⋯ 20 unchanged lines
155149 ---
156150
157151 > [!NOTE]
158 −> Configured elliptic curves determine the cryptographic strength of the ECDHE key exchange. For more information, see [Manage Transport Layer Security (TLS)](manage-tls.md#configuring-tls-ecc-curve-order).
152 +> Configured elliptic curves determine the cryptographic strength of the ECDHE key exchange. For more information, see [Manage Transport Layer Security (TLS)](manage-tls.md#configure-tls-ecc-curve-order).
159153
160154 ## MaximumCacheSize
161155
162 −This entry controls the maximum number of TLS sessions to cache. Setting MaximumCacheSize to `0` disables the
163 −server-side session cache to prevent session resumption. Increasing MaximumCacheSize above the
164 −default values causes Lsass.exe to consume extra memory. Each session-cache element typically
156 +This entry controls the maximum number of TLS sessions to cache. Setting MaximumCacheSize to `0` disables the server-side session cache to prevent session resumption. Increasing MaximumCacheSize above the default values causes Lsass.exe to consume extra memory. Each session-cache element typically
165157 requires 2 KB to 4 KB of memory. This entry doesn't exist in the registry by default. The default
166158 value is 20,000 elements.
167159
168 −Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.
169 −
170160 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`
171161
172162 ## Messaging – fragment parsing
⋯ 16 unchanged lines
189179
190180 ## SendTrustedIssuerList
191181
192 −TLS servers might send a list of the distinguished names of acceptable certificate authorities when requesting client authentication. This can help TLS clients select an appropriate TLS client certificate. SChannel-based TLS servers don't send this trusted issuer list by default because it exposes the certificate authorities trusted by the server to passive observers and also increases the amount of data exchanged in the course of the TLS handshake. Setting this value to *1* causes SChannel-based servers to send their lists of trusted issuers.
182 +TLS servers might send a list of the distinguished names of acceptable certificate authorities when requesting client authentication. This can help TLS clients select an appropriate TLS client certificate. Schannel-based TLS servers don't send this trusted issuer list by default because it exposes the certificate authorities trusted by the server to passive observers and also increases the amount of data exchanged in the course of the TLS handshake. Setting this value to *1* causes Schannel-based servers to send their lists of trusted issuers.
193183
194184 Not sending a list of trusted issuers might affect what the client sends when it's asked for a client certificate. For example, when Microsoft Edge receives a request for client authentication, it only displays the client certificates that chain up to one of the certification authorities that's sent by the server. If the server didn't send a list, Microsoft Edge displays all of the client certificates that are installed on the client.
195185
⋯ 4 unchanged lines
200190 | Windows version | Default behavior |
201191 |-----------------|------|
202192 | Windows Server 2012, Windows 8, and later | FALSE |
203 −| Windows Server 2008 R2, Windows 7, and earlier | TRUE |
204193
205 −Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.
206 −
207194 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`
208195
209196 ## ServerCacheTime
210197
211198 This entry specifies server TLS session cache item lifetime in milliseconds. The default is 10 hours. A value of *0* turns off TLS session caching on the server and prevents session resumption. Increasing ServerCacheTime above the default values causes Lsass.exe to consume additional memory. Each session cache element typically requires 2 KB to 4 KB of memory. This entry doesn't exist in the registry by default.
212199
213 −Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.
214 −
215200 Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`
216201
217202 Default server cache time: 10 hours
⋯ 4 unchanged lines
222207
223208 A supported (D)TLS or SSL protocol version can exist in one of the following states:
224209
225 −- **Enabled**: Unless the SSPI caller explicitly disables this protocol version using [SCH_CREDENTIALS](/windows/win32/api/schannel/ns-schannel-sch_credentials) structure, SChannel SSP might negotiate this protocol version with a supporting peer.
226 −- **Disabled**: SChannel SSP doesn't negotiate this protocol version regardless of the settings the SSPI caller might specify.
210 +- **Enabled**: Unless the SSPI caller explicitly disables this protocol version using [SCH_CREDENTIALS](/windows/win32/api/schannel/ns-schannel-sch_credentials) structure, Schannel SSP might negotiate this protocol version with a supporting peer.
211 +- **Disabled**: Schannel SSP doesn't negotiate this protocol version regardless of the settings the SSPI caller might specify.
227212
228213 These registry values are configured separately for the protocol client and server roles under the registry subkeys named using the following format:
229214
⋯ 27 unchanged lines
257242
258243 Once the (D)TLS or SSL protocol version settings are modified, they take effect on connections established using credential handles opened by subsequent [AcquireCredentialsHandle](/windows/win32/secauthn/acquirecredentialshandle--schannel) calls. (D)TLS and SSL client and server applications and services tend to reuse credential handles for multiple connections, for performance reasons. In order to get these applications to reacquire their credential handles, an application, or service restart might be required.
259244
260 −These registry settings only apply to SChannel SSP and don't affect any third-party (D)TLS and SSL implementations that might be installed on the system.
245 +These registry settings only apply to Schannel SSP and don't affect any third-party (D)TLS and SSL implementations that might be installed on the system.
261246
262247 > [!WARNING]
263 −> Attempting to create or adjust any SChannel registry settings that are not explicitly detailed in this article isn't recommended due to potential risks and unintended consequences that may arise from unsupported configurations.
248 +> Attempting to create or adjust any Schannel registry settings that aren't explicitly detailed in this article isn't recommended due to potential risks and unintended consequences that may arise from unsupported configurations.
264249
265250 To learn about managing the TLS cipher suite using PowerShell, see [TLS command reference](/powershell/module/tls). If interested in managing TLS settings via Group Policy, see [Configure TLS cipher suite order by using Group Policy](/windows-server/security/tls/manage-tls#configure-tls-cipher-suite-order-by-using-group-policy).

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:07 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 23:56 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.