How to disable SSL 2.0, TLS 1.0 and TLS 1.1 in Windows 10

This video shows you how to disable the support for older weaker ciphers, such as SSL 2.0, TLS 1.0 and TLS 1.1.

These weak ciphers are regularly picked up on security audits as well as Cyber Essentials assessments, which can be easily remediated.

Go into regedit, then go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\

From there create a new Key for 'SSL 2.0', 'TLS 1.0' and 'TLS 1.1'

for instance: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0

Then, create a client and server key inside the protocol you are disabling

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client

Then create a DWORD value called 'Enabled' with the default value of 0. If the value has 1, then this enables the weaker cipher.

Call us at: 01325 628587

Connect with TeraByte at:

[jerryperry]

This took me to the location of TLS protocol control that was literally stopping me from upgrading my Enterprise environment to Windows 10. Thank you for this video, it made my week! Modified the settings to actually Enable TLS 1.0 and our secure connectivity issue was resolved. It's inside an encrypted VPN tunnel so the traffic, although encrypted with outdated protocol is still safely tucked away in our tunnel.

[sakanet]

Thanks for this short but useful tutorial!

I am on Windows 10. I followed your instructions and verified it twice to make sure i got it right but, unfortunately, it didn't work for me.

After I created the registry keys, I restarted the computer and scanned it with nmap tool with this command:

nmap -sV -p 4343 --script ssl-enum-ciphers <here computerIP address>

I still see that TLS 1.0 and TLS 1.1 are being used.

Here's part of the scan result:

| ssl-enum-ciphers:

| TLSv1.0:

| ciphers:

| (secp256r1) - A

| (secp256r1) - A

| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A

| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 1024) - A

| compressors:

| NULL

| cipher preference: client

| TLSv1.1:

| ciphers:

| (secp256r1) - A

| (secp256r1) - A

| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A

| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 1024) - A

| compressors:

| NULL

| cipher preference: client

| TLSv1.2:

| ciphers:

| (secp256r1) - A

| (secp256r1) - A

| (secp256r1) - A

| (secp256r1) - A

| (secp256r1) - A

| (secp256r1) - A

| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A

| (rsa 1024) - A

| TLS_RSA_WITH_AES_128_CCM (rsa 1024) - A

| TLS_RSA_WITH_AES_128_CCM_8 (rsa 1024) - A

| (rsa 1024) - A

| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 1024) - A

| (rsa 1024) - A

| TLS_RSA_WITH_AES_256_CCM (rsa 1024) - A

| TLS_RSA_WITH_AES_256_CCM_8 (rsa 1024) - A

| (rsa 1024) - A

| compressors:

| NULL

| cipher preference: client

|_ least strength: A

Please let me know if you can think of anything else to disable these protocols.
Thanks!

[rajesh]

This video is a nice walk through on the remediation. Can we do this for SSL 3.0 vulnerabilities too ?

[fasdfasdf]

Thank you for the video. I'm on Windows 10 and was wondering how would I run the test scan like you did to see which versions are enabled/disabled afterwards. Thanks again!

[ironblader]

hm, cant test my system: ERROR: Could not open a connection to host 192.168.178.10 (192.168.178.10) on port 443 what to do? win10 eset fw is disabled (Kali Linux 2021.1 on VMWare16, Win10Pro)