Growing trends in cyber attacks made system administrators implement more secure communication protocols to protect their assets and network from attacks. TLS plays a vital role in the implementation stack. TLS is a critical security protocol that is used to encrypt communications between clients and servers. TLS 1.2 and TLS 1.3 are the two latest versions of the Transport Layer Security (TLS) protocol and offer many advantages over their previous versions. TLS 1.2 is the most widely used version of the TLS protocol, but TLS 1.3 is gaining popularity because of its efficiency and speed. As a system administrator, you should enable TLS 1.2 and TLS 1.3 on your Windows Server to enhance the security of your infrastructure, but wait, that’s not enough. You should disable TLS 1.0 and TLS 1.1 on Windows Server as they are deprecated for their weak security.
Before learning how to disable TLS 1.0 and TLS 1.1 on your Windows Server, let’s see about TLS 1.0 and TLS 1.1 and why you should disable TLS 1.0 and TLS 1.1 on your Windows Server
A Short Note About TLS 1.0 and TLS 1.1:
The Transport Layer Security (TLS) protocols are cryptographic protocols that provide communication security over the Internet. TLS 1.0 and TLS 1.1 are the two previous versions of the TLS protocol.
TLS 1.0 was first defined in 1999, and TLS 1.1 was published as an update to TLS 1.0 in 2006. TLS 1.0 and TLS 1.1 are now considered to be obsolete, and they are no longer considered secure.
Why You Should Disable TLS 1.0 and TLS 1.1 on Windows Server?
There are a few reasons why you should disable TLS 1.0 and TLS 1.1 on Windows Server:
- TLS 1.0 and TLS 1.1 are no longer considered secure, due to the fact that they are vulnerable to various attacks, such as the POODLE attack.
- Disabling TLS 1.0 and TLS 1.1 on your server will force clients to use a more secure protocol (TLS 1.2), which is less vulnerable to attack.
- Some government agencies, such as the US National Security Agency (NSA), have recommended that TLS 1.0 and TLS 1.1 be disabled.
- Microsoft will no longer provide security updates for Windows Server running TLS 1.0 and TLS 1.1.
- Many major software vendors are phasing out support for TLS 1.0 and TLS 1.1. This includes Google, Microsoft, Mozilla, and Apple.
Attacks TLS 1.0 and TLS 1.1 are vulnerable to:
There are a number of known vulnerabilities in TLS 1.0 and TLS 1.1 that can be exploited by attackers. These include:
- POODLE (Padding Oracle On Downgraded Legacy Encryption)
- BEAST (Browser Exploit Against SSL/TLS)
- CRIME (Compression Ratio Info-leak Made Easy)
- FREAK (Factoring Attack on RSA-EXPORT Keys)
- LOGJAM (Diffie-Hellman Key Exchange Weakness)
These vulnerabilities allow attackers to perform man-in-the-middle attacks, decrypt sensitive information, and hijack user sessions. By disabling TLS 1.0 and TLS 1.1 on your Windows server, you can protect yourself from these attacks.
What is the Alternate to TLS 1.0 and TLS 1.1?
The current version of the TLS protocol is TLS 1.3. TLS 1.3 was first defined in 2018, and it includes a number of security improvements over previous versions of the TLS protocol. We suggest you to enable TLS 1.2 and TLS 1.3 on your Windows Server instead of TLS 1.0 and TLS 1.1.
TLS 1.2 improves upon TLS 1.1 by adding support for Elliptic Curve Cryptography (ECC) and introducing new cryptographic suites that offer better security than the suites used in TLS 1.1. TLS 1.3 improves upon TLS 1.2 by simplifying the handshake process and making it more resistant to man-in-the-middle attacks. In addition, TLS 1.3 introduces new cryptographic suites that offer better security than the suites used in TLS 1.2.
TLS 1.2 and TLS 1.3 are both backward compatible with TLS 1.1 and earlier versions of the protocol. This means that a client that supports TLS 1.2 can communicate with a server that supports TLS 1.1 and vice versa. However, TLS 1.2 and TLS 1.3 are not compatible with each other. A client that supports TLS 1.2 cannot communicate with a server that supports TLS 1.3, and vice versa.
TLS 1.2 is the most widely used version of the TLS protocol, but TLS 1.3 is gaining in popularity. Many major web browsers, including Google Chrome, Mozilla Firefox, and Microsoft Edge, now support TLS 1.3. In addition, major Internet services providers, such as Cloudflare and Akamai, have started to support TLS 1.3 on their servers. Please visit this page if you want to deeply review the comparison of TLS implementations across different supported servers and clients.
Please visit these posts to learn more about TLS 1.2 and TLS 1.3:
- What Is SSL/TLS? How SSL, TLS 1.2, And TLS 1.3 Differ From Each Other?
- Decoding TLS v1.2 protocol Handshake with Wireshark
- Decoding TLS 1.3 Protocol Handshake With Wireshark
- How to Enable TLS 1.3 in Standard Web Browsers?
- How to Enable TLS 1.3 on Popular Web Servers?
- How to Enable TLS 1.2 and TLS 1.3 on Windows Server
- How to Disable TLS 1.0 and TLS 1.1 on Your Apache Server?
- How to Disable TLS 1.0 and TLS 1.1 on Your Nginx Server?
How to Disable TLS 1.0 and TLS 1.1 on Windows Server?
We have covered 3 different ways to disable TLS 1.0 and TLS 1.1 on your Windows Server in this post. You can choose any one of the three ways to disable TLS 1.0 and TLS 1.1 on your Windows Server depending on your technical and automation skills.
- Disable TLS 1.0 and TLS 1.1 manually using Registry
- Disable TLS 1.0 and TLS 1.1 using Powershell Commands
- Disable TLS 1.0 and TLS 1.1 using CMD
Note: Microsoft clearly said that it doesn’t support TLS 1.0 and TLS 1.1 on Windows operating systems. No patches will be provided for TLS 1.0 and TLS 1.1 from Microsoft. You can refer to the below table that shows the Microsoft Schannel Provider support of TLS protocol versions.
TLS Protocols Supported by Windows Operating Systems:
| Windows OS | TLS 1.0 Client | TLS 1.0 Server | TLS 1.1 Client | TLS 1.1 Server | TLS 1.2 Client | TLS 1.2 Server | TLS 1.3 Client | TLS 1.3 Server |
|---|---|---|---|---|---|---|---|---|
| Windows Vista/Windows Server 2008 | Enabled | Enabled | Not supported | Not supported | Not supported | Not supported | Not supported | Not supported |
| Windows Server 2008 with Service Pack 2 (SP2) | Enabled | Enabled | Disabled | Disabled | Disabled | Disabled | Not supported | Not supported |
| Windows 7/Windows Server 2008 R2 | Enabled | Enabled | Disabled | Disabled | Disabled | Disabled | Not supported | Not supported |
| Windows 8/Windows Server 2012 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 8.1/Windows Server 2012 R2 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 1507 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 1511 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 1607/Windows Server 2016 Standard | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 1703 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 1709 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 1803 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 1809//Windows Server 2019 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 1903 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 1909 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 2004 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not supported | Not supported |
| Windows 10, version 20H2 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not Supported | Not Supported |
| Windows 10, version 21H1 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not Supported | Not Supported |
| Windows 10, version 21H2 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Not Supported | Not Supported |
| Windows Server 2022 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled |
| Windows 11 | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled |
Method 1 : Disable TLS 1.0 and TLS 1.1 manually using Registry
Let’s begin learning how to disable TLS 1.0 and TLS 1.1 manually using Windows Registry.
Time needed: 15 minutes.
- Open regedit utility
Open ‘Run‘, type ‘regedit’ and click ‘OK’.
- Create New Key
In Registry Editor, navigate to the path : Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
Create a new key by Right click on ‘Protocols‘ –> New –> Key.
- Rename the Registry Key ‘TLS 1.0’
Name key as ‘TLS 1.0‘
Rename the registry key as ‘TLS 1.0‘.
- Create One More Registry Key ‘Client’ underneath ‘TLS 1.0’
As smiler to the above step, create another key as ‘Client‘ underneath ‘TLS 1.0‘ as shone in this picture.
- Create New Item ‘DWORD (32-bit) Value’ Underneath ‘Client’
Create new item by right click on ‘Client‘, select ‘New’ –> DWORD (32-bit) Value.
- Rename the Item ‘DWORD (32-bit) Value’ to ‘Enable’
We Name the item as ‘Enabled‘ with Hexadecimal value as ‘0‘.
- Create another item, ‘DisabledByDefault’ Underneath TLS 1.0
Similarly, create another item, ‘DisabledByDefault‘, with a Hexadecimal value as ‘1‘.
- Create ‘Server’ and corresponding Keys as in the case of ‘Client’
Similar to the above steps, create a key ‘Server‘ under ‘Protocols‘ and create registry items ‘DWORD (32-bit)’ and ‘Enabled’ as shown below.
- Disable TLS 1.1 on the Windows Server
Similar to the above steps, create a key ‘TLS 1.1’ under ‘Protocols‘ and below keys and items to Disable ‘TLS 1.1’
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\Enabled with Hexadecimal value as ‘0’
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\DisabledByDefault with Hexadecimal value as ‘1’
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\Enabled with Hexadecimal value as ‘0’
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\DisabledByDefault with Hexadecimal value as ‘1’ -
Method 2 : Disable TLS 1.0 and TLS 1.1 using Powershell commands
Follow this simple procedure to enable TLS 1.2 and TLS 1.2 using Powershell commands.
- Open Powershell as Administrator
2. Run the below commands to create Registry entries
- New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Force
- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' –PropertyType 'DWORD' -Name 'Enabled' -Value '0'
- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1'
- New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -Force
- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -PropertyType 'DWORD' -Name 'Enabled' -Value '0'
- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1'
- New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Force
- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' –PropertyType 'DWORD' -Name 'Enabled' -Value '0'
- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1'
- New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -Force
- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -PropertyType 'DWORD' -Name 'Enabled' -Value '0'
- New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' –PropertyType 'DWORD' -Name 'DisabledByDefault' -Value '1'Before running the commands, you can see no items exist underneath Protocol.
After running the commands you can see there are two keys created ‘TLS 1.0’ & ‘TLS 1.1’, Underneath each protocols there are ‘Client’ &’Server’ Keys inside them ther are two items ‘DisableByDefault’ & ‘Enabled’.
Method 3 : Disable TLS 1.0 and TLS 1.1 on Windows Server using CMD
Follow this simple procedure to disable TLS 1.0 and TLS 1.1 using CMD comments.
- Open ‘Command Prompt’ as Administrator
2. Run the below commands to create Registry entries.
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v Enabled /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v DisabledByDefault /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v Enabled /t REG_DWORD /d 0 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" /v DisabledByDefault /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v Enabled /t REG_DWORD /d 0 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v DisabledByDefault /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v Enabled /t REG_DWORD /d 0 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v DisabledByDefault /t REG_DWORD /d 1 /fWe hope this post would help you know how to disable TLS 1.0 and TLS 1.1 on your Windows Server as they are deprecated for their weak security. Please share this post if you find this interested. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium & Instagram, and subscribe to receive updates like this.
Frequently Asked Questions:
TLS 1.0 and TLS 1.1 are older versions of the Transport Layer Security (TLS) protocol, which is designed to provide secure communication over computer networks. These versions have been deprecated due to various security vulnerabilities and have been replaced by more secure and modern versions like TLS 1.2 and TLS 1.3.TLS 1.0 and TLS 1.1 are older versions of the Transport Layer Security (TLS) protocol, which is designed to provide secure communication over computer networks. These versions have been deprecated due to various security vulnerabilities and have been replaced by more secure and modern versions like TLS 1.2 and TLS 1.3.
Disabling TLS 1.0 and TLS 1.1 on your Windows Server helps protect your server from potential security vulnerabilities and ensures compliance with security standards and best practices. It also encourages clients to use more secure and modern versions of the TLS protocol, such as TLS 1.2 and TLS 1.3.
To disable TLS 1.0 and TLS 1.1 on your Windows Server, follow these steps:
1. Open the Registry Editor by pressing Win + R, typing regedit, and pressing Enter.
2. Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
3. Under the Protocols key, create new keys for TLS 1.0 and TLS 1.1 if they do not exist.
4. Under each TLS version key, create subkeys named Client and Server.
5. Create a new DWORD (32-bit) value named Enabled under both Client and Server subkeys, and set its value to 0.
6. Create a new DWORD (32-bit) value named DisabledByDefault under both Client and Server subkeys, and set its value to 1.
7. Close the Registry Editor and restart your server to apply the changes.
Yes, you can disable TLS 1.0 and TLS 1.1 on other operating systems, such as Linux and macOS. The process may vary depending on the platform and the software used, but the overall goal remains the same: to ensure that your server no longer accepts connections using less secure versions of the TLS protocol.
Disabling TLS 1.0 and TLS 1.1 may affect compatibility with older clients that do not support more modern versions of the TLS protocol. However, the majority of modern web browsers, applications, and devices now support TLS 1.2 and TLS 1.3. It is highly recommended to encourage clients to update their software to support these newer and more secure versions of the TLS protocol.
You can use a third-party tool like Nmap (https://nmap.org/) or SSL Labs’ SSL Server Test (https://www.ssllabs.com/ssltest/) to scan your server and determine if TLS 1.0 and TLS 1.1 are disabled.
Disabling TLS 1.0 and TLS 1.1 on your Windows Server does not require updating your existing SSL/TLS certificates. However, it is essential to ensure that your certificates are valid, up to date, and issued by a trusted Certificate Authority (CA). If your certificates are about to expire or if you have concerns about their security, consider obtaining new certificates to maintain a secure and trustworthy connection.
Yes, you can disable TLS 1.0 and TLS 1.1 for specific applications or services on your Windows Server. The process may vary depending on the application or service, but it typically involves configuring the application’s settings or modifying its configuration files. Refer to the documentation for the specific application or service for more information on how to disable the older TLS versions.
To ensure that your Windows Server is using the most secure encryption standards after disabling TLS 1.0 and TLS 1.1, follow these steps:
1. Enable the latest versions of the TLS protocol, such as TLS 1.2 and TLS 1.3, following the instructions provided in the FAQ about enabling TLS 1.2 and TLS 1.3 on Windows Server.
2. Regularly update your server’s operating system and installed software to apply security patches and improvements.
3. Use strong cipher suites that provide robust encryption, authentication, and key exchange.
4. Keep your SSL/TLS certificates up to date and ensure they are issued by a trusted Certificate Authority (CA).
Not disabling TLS 1.0 and TLS 1.1 can expose your Windows Server to several potential security risks, including:
1. Vulnerabilities in the older TLS protocol versions, such as BEAST, POODLE, and DROWN.
2. Weak encryption algorithms and cipher suites that are easier for attackers to exploit.
3. Non-compliance with security standards and best practices, which may lead to penalties or reputational damage.
4. Reduced compatibility with modern clients that prefer or require more secure versions of the TLS protocol.
To monitor the TLS connections on your Windows Server, you can use built-in tools, such as Performance Monitor or Event Viewer, or third-party monitoring solutions that provide more detailed information and analysis. By monitoring your server’s TLS connections, you can ensure that your server is using the desired versions of the TLS protocol, identify potential security issues, and optimize your server’s performance.
Hi Arun,
You wrote
"How to Disable TLS 1.0 and TLS 1.1 on Windows Server?
We have covered 3 different ways to disable TLS 1.2 and TLS 1.3 on your Windows Server in this post. You can choose any one of the three ways to disable TLS 1.2 and TLS 1.3 on your Windows Server depending on your technical and automation skills."
But don't you mean:
"How to Disable TLS 1.0 and TLS 1.1 on Windows Server?
We have covered 3 different ways to disable TLS 1.0 and TLS 1.1 on your Windows Server in this post. You can choose any one of the three ways to disable TLS 1.0 and TLS 1.1 on your Windows Server depending on your technical and automation skills."
Steps by steps are very well explained but they show disabling TLS 1.0 and TLS 1.1 and not TLS 1.2 and 1.3
Thanks, Louise for notifying this. It’s been corrected now.
Great blog post Arun. Please note, these changes do not come into affect until a reboot/restart is done.
Richard.
Thanks, Richard. Your comments will be published as this information give other readers a reminder about the reboot.
Great tutorial!! as a newbie admin like me help a lot to know a few method to modify the win registry , method 3 by far the best for me.
Hi Bill,
We are pleased to know that this piece of information is useful for someone. Thanks for your comments!
Methos 1 has a few errors – seems like you have switched what should be disabled and what should be enabled:
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\Enabled with Hexadecimal value as ‘1’ – SHOULD BE SET TO 0!
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client\DisabledByDefault with Hexadecimal value as ‘0’ – SHOULD BE SET TO 1!
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\Enabled with Hexadecimal value as ‘1’ – SHOULD BE SET TO 0!
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server\DisabledByDefault with Hexadecimal value as ‘0’ – SHOULD BE SET TO 1!
Thanks, Gorm.
You are absolutely correct. We will correct the error and update it again.
This content compiles factual information which has helped me a lot as a reader.
We are pleased to hear that. Thanks for your comment.