TLS registry settings

This page's changes and edits · All guidance changes

Microsoft's edit · 29 Aug 2024 00:43 UTC

Incorporate feedback

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit ea142aa · +25 ~~−31~~ lines · also on GitHub

⋯ 15 unchanged lines

1616

1717 ## SChannel logging

1818

19 −There are eight logging levels for SChannel events saved to the system event log and viewable using Event Viewer. This registry path is stored in **HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL** under the **EventLogging** key with a DWORD value set to *1*.

19 +There are eight logging levels for SChannel events saved to the system event log and viewable using Event Viewer. This registry path is stored in `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL` under the **EventLogging** key with a DWORD value set to *1*.

2020

2121 | Decimal or Hex | SChannel logging events |

2222 |---|---|

⋯ 27 unchanged lines

5050 1. One-to-one mapping (also known as subject/issuer mapping)

5151 1. Many-to-one mapping

5252

53 −Registry path: **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL**

53 +Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

5454

5555 |Entry name|DWORD|Enabled by default|

5656 |--|--|--|

⋯ 21 unchanged lines

7878

7979 This entry specifies client TLS session cache item lifetime in milliseconds. Beginning with Windows Server 2008 and Windows Vista the default is 10 hours. A value of *0* turns off TLS session caching on the client.

8080

81 −The first time a client connects to a server through the SChannel SSP, a full TLS/SSL handshake is performed. When complete, the main secret, cipher suite, and certificates are stored in the session cache on the respective client and server.

81 +The first time a client connects to a server through the SChannel SSP, a full TLS/SSL handshake is performed. When complete, the master secret, cipher suite, and certificates are stored in the session cache on the respective client and server.

8282

83 −Registry path: **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL**

83 +Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

8484

8585 ## EnableOcspStaplingForSni

8686

⋯ 10 unchanged lines

9797

9898 Applicable versions: All versions beginning with Windows Server 2012 and Windows 8.

9999

100 −Registry path: **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL**

100 +Registry path: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

101101

102102 Add the following key:

103103

⋯ 18 unchanged lines

122122

123123 Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.

124124

125 −Registry path: **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL**

125 +Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

126126

127127 ## IssuerCacheTime

128128

⋯ 3 unchanged lines

132132

133133 Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.

134134

135 −Registry path: **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL**

135 +Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

136136

137137 ## KeyExchangeAlgorithm key sizes

138138

⋯ 3 unchanged lines

142142

143143 Added in Windows 10, version 1507, and Windows Server 2016.

144144

145 −Registry path: **HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman**

146 −

147 −To specify a minimum supported range of Diffie-Hellman key bit length for the TLS client, create a *ClientMinKeyBitLength* entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, 1024 bits is the minimum.

148 −

149 −To specify a maximum supported range of Diffie-Hellman key bit length for the TLS client, create a *ClientMaxKeyBitLength* entry. After you create the entry, change the DWORD value to the desired bit length.

145 +Registry path: `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman`

150146

151 −To specify the Diffie-Hellman key bit length for the TLS server default, create a *ServerMinKeyBitLength* entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, 2048 bits is the default.

147 +To specify a minimum supported range of Diffie-Hellman key bit length for the TLS client, create a `ClientMinKeyBitLength` entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, 1024 bits is the minimum.

152148

153149 # [RSA](#tab/rsa)

154150

155151 Added in Windows 10, version 1507, and Windows Server 2016.

156152

157 −Registry path: **HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS**

158 −

159 −To specify a minimum supported range of RSA key bit length for the TLS client, create a *ClientMinKeyBitLength* entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, 1024 bits is the minimum.

153 +Registry path: `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS`

160154

161 −To specify a maximum supported range of RSA key bit length for the TLS client, create a *ClientMaxKeyBitLength* entry. After you create the entry, change the DWORD value to the desired bit length. On the server-side, the strength of the RSA key exchange is controlled by the specified server certificate.

155 +To specify a minimum supported range of RSA key bit length for the TLS client, create a `ClientMinKeyBitLength` entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, 1024 bits is the minimum. On the server-side, the strength of the RSA key exchange is controlled by the specified server certificate.

162156

163157 ---

164158

⋯ 10 unchanged lines

175169

176170 Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.

177171

178 −Registry path: **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL**

172 +Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

179173

180174 ## Messaging – fragment parsing

181175

⋯ 5 unchanged lines

187181

188182 Added in Windows 7 and Windows Server 2008 R2: An update that enables Internet Explorer in Windows XP, in Windows Vista, or in Windows Server 2008 to parse fragmented TLS/SSL handshake messages is available.

189183

190 −Registry path: **HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Messaging**

184 +Registry path: `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Messaging`

191185

192 −To specify a maximum allowed size of fragmented TLS handshake messages that the TLS client accepts, create a *MessageLimitClient* entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, the default value is *0x8000* bytes.

186 +To specify a maximum allowed size of fragmented TLS handshake messages that the TLS client accepts, create a `MessageLimitClient` entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, the default value is *0x8000* bytes.

193187

194 −To specify a maximum allowed size of fragmented TLS handshake messages that the TLS server accepts when there's no client authentication, create a *MessageLimitServer* entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, the default value is *0x4000* bytes.

188 +To specify a maximum allowed size of fragmented TLS handshake messages that the TLS server accepts when there's no client authentication, create a `MessageLimitServer` entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, the default value is *0x4000* bytes.

195189

196 −To specify a maximum allowed size of fragmented TLS handshake messages that the TLS server accepts when there's client authentication, create a *MessageLimitServerClientAuth* entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, the default value is *0x8000* bytes.

190 +To specify a maximum allowed size of fragmented TLS handshake messages that the TLS server accepts when there's client authentication, create a `MessageLimitServerClientAuth` entry. After you create the entry, change the DWORD value to the desired bit length. If not configured, the default value is *0x8000* bytes.

197191

198192 ## SendTrustedIssuerList

199193

⋯ 12 unchanged lines

212206

213207 Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.

214208

215 −Registry path: **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL**

209 +Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

216210

217211 ## ServerCacheTime

218212

⋯ 1 unchanged line

220214

221215 Applicable versions: All versions beginning with Windows Server 2008 and Windows Vista.

222216

223 −Registry path: **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL**

217 +Registry path: `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`

224218

225219 Default server cache time: 10 hours

226220

⋯ 12 unchanged lines

239233

240234 These version-specific subkeys can be created under the following registry path:

241235

242 −- **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols**

236 +- `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols`

243237

244238 For example, here are some valid registry paths with version-specific subkeys:

245239

246 −- **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client**

240 +- `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client`

247241

248 −- **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server**

242 +- `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server`

249243

250 −- **HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.2\Client**

244 +- `HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\DTLS 1.2\Client`

251245

252 −In order to override a system default and set a supported (D)TLS or SSL protocol version to the **Enabled** state, create a DWORD registry value named "Enabled" with an entry value of "**1**" under the corresponding version-specific subkey.

246 +In order to override a system default and set a supported (D)TLS or SSL protocol version to the `Enabled` state, create a DWORD registry value named `Enabled` with an entry value of "**1**" under the corresponding version-specific subkey.

253247

254248 The following example shows TLS 1.0 client set to the **Enabled** state:

255249

256250 :::image type="content" source="images/tls-10-client-enabled.png" alt-text="Screenshot of Set TLS 1.0 client-side to enabled in Windows Server registry setting.":::

257251

258 −In order to override a system default and set a supported (D)TLS or SSL protocol version to the *Disabled* state, change the DWORD registry value of "Enabled" to *0* under the corresponding version-specific subkey.

252 +In order to override a system default and set a supported (D)TLS or SSL protocol version to the `Disabled` state, change the DWORD registry value of `Enabled` to "**0**" under the corresponding version-specific subkey.

259253

260254 The following example shows DTLS 1.2 disabled in the registry:

261255

262256 :::image type="content" source="images/dtls-12-server-disabled.png" alt-text="Screenshot of Windows Server registry setting for DTLS 1.2 set to disabled by default.":::

263257

264 −Switching a (D)TLS or SSL protocol version to *Disabled* state might cause [AcquireCredentialsHandle](/windows/win32/secauthn/acquirecredentialshandle--schannel) calls to fail due to the lack of protocol versions enabled system-wide and at the same time allowed by particular SSPI callers. In addition, reducing the set of *Enabled* (D)TLS and SSL versions could break interoperability with remote peers.

258 +Switching a (D)TLS or SSL protocol version to `Disabled` state might cause [AcquireCredentialsHandle](/windows/win32/secauthn/acquirecredentialshandle--schannel) calls to fail due to the lack of protocol versions enabled system-wide and at the same time allowed by particular SSPI callers. In addition, reducing the set of `Enabled` (D)TLS and SSL versions could break interoperability with remote peers.

265259

266260 Once the (D)TLS or SSL protocol version settings are modified, they take effect on connections established using credential handles opened by subsequent [AcquireCredentialsHandle](/windows/win32/secauthn/acquirecredentialshandle--schannel) calls. (D)TLS and SSL client and server applications and services tend to reuse credential handles for multiple connections, for performance reasons. In order to get these applications to reacquire their credential handles, an application, or service restart might be required.

267261

⋯ 6 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:07 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.