TLS registry settings

This page's changes and edits · All guidance changes

Microsoft's edit · 3 Sep 2024 09:00 UTC

Apply suggestions from code review

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 944007d · +3 −3 lines · also on GitHub

⋯ 160 unchanged lines

161161

162162 ## MaximumCacheSize

163163

164 −This entry controls the maximum number of TLS sessions to cache. Setting MaximumCacheSize to *0* disables the

164 +This entry controls the maximum number of TLS sessions to cache. Setting MaximumCacheSize to `0` disables the

165165 server-side session cache to prevent session resumption. Increasing MaximumCacheSize above the

166166 default values causes Lsass.exe to consume extra memory. Each session-cache element typically

167167 requires 2 KB to 4 KB of memory. This entry doesn't exist in the registry by default. The default

⋯ 7 unchanged lines

175175

176176 This entry controls the maximum allowed size of a TLS handshake message that's accepted. Messages larger than the allowed size aren't accepted and the TLS handshake fails. These entries don't exist in the registry by default.

177177

178 −When you set the value to *0x0*, fragmented messages aren't processed and causes the TLS handshake to fail. This makes TLS clients or servers on the current machine noncompliant with the TLS RFCs.

178 +When you set the value to `0x0`, fragmented messages aren't processed and causes the TLS handshake to fail. This makes TLS clients or servers on the current machine noncompliant with the TLS RFCs.

179179

180180 The maximum allowed size can be increased up to 2^16 bytes. Allowing a client or server to read and store large amounts of unverified data from the network isn't a good idea and consumes extra memory for each security context.

181181

⋯ 1 unchanged line

183183

184184 Registry path: `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Messaging`

185185

186 −To specify a maximum allowed size of fragmented TLS handshake messages that the TLS client accepts, create a `MessageLimitClient` entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, the default value is *0x8000* bytes.

186 +To specify a maximum allowed size of fragmented TLS handshake messages that the TLS client accepts, create a `MessageLimitClient` entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, the default value is `0x8000` bytes.

187187

188188 To specify a maximum allowed size of fragmented TLS handshake messages that the TLS server accepts when there's no client authentication, create a `MessageLimitServer` entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, the default value is *0x4000* bytes.

189189

⋯ 78 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:07 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.