I have a .NET desktop application with an SQL Server 2016 Express SP1 back end running the latest cumulative update 3.

I have enabled TLS 1.3 on both server (Windows Server 2012 R2) and client (Windows 10 Pro) machines via the registry in the same way that I enabled TLS 1.2.

When I activate encryption of data in transit, the packets are showing that the negotiated protocol is TLS 1.2. How can the protocol be increased to TLS 1.3?

  • Chrome canary (Beta) has TLS 1.3. – jwilleke Aug 6 '17 at 21:20

This is probably not news, but since the TLS 1.3 RFC is still in DRAFT, you'll probably cause yourself compatibility headaches if you turn it on for a production server.

I would guess this is exactly what you're running up against: TLS 1.3 may exist in some places, but is probably not fully supported all the way through both the client and server stacks; either some component doesn't support it, or they support mis-matched versions of the 1.3 draft, and they and up agreeing on 1.2. Just a guess.

Also note that (as far as I'm aware) TLS 1.2 --> TLS 1.3 is more about performance improvements and simplifying the protocol than about security. While there are a lot of good changes in 1.3, there's no security need to be a bleeding-edge adopter.

  • So should I leave TLS 1.3 enabled so that it will use this protocol when it becomes available or am I better off disabling it until I know it's available? – Guru Josh Aug 5 '17 at 4:04
  • I don't think I can answer that for you, it will depend on the vendor (Microsoft in this case). When the TLS 1.3 spec is eventually finalized, will the libraries you have installed now be compatible with the rest of the world, or will you have to patch it / tweak config? There's probably no harm in leaving it enabled, but like all brand-new technologies, expect some bumps at the beginning. – Mike Ounsworth Aug 5 '17 at 4:17
  • I'm sorry Mike, but I do not agree with your statement. If you define cipher suites that are based on TLS 1.3 there is no problem with doing that, as long as you have other suites defined too. Also in Microsoft Windows TLS 1.3 is not available in Schannel yet, although the cipher suites itself are available and therefore there is no goal with implementing. But if you do so (what I recommend) as soon as the Schannel update is comming, your server is immediately using the TLS 1.3 ciphers. Of course to do so, you have to put the TLS 1.3 cipher suites in top of the cipher suite order. – KrasseChecker Jul 18 '18 at 6:39

TLS v1.3 does not exist in schannel (the Windows TLS library) yet, so it can neither be enabled, nor will it be able to cause any problems.

Your app will continue to use TLS v1.2, assuming that is the version negotiated by the client and the server in this scenario until a TLS v1.3 implementation is addded to schannel, it's been made available for the the OSes in question, and then installed on your machines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.