9

I have a .NET desktop application with an SQL Server 2016 Express SP1 back end running the latest cumulative update 3.

I have enabled TLS 1.3 on both server (Windows Server 2012 R2) and client (Windows 10 Pro) machines via the registry in the same way that I enabled TLS 1.2.

When I activate encryption of data in transit, the packets are showing that the negotiated protocol is TLS 1.2. How can the protocol be increased to TLS 1.3?

Improve this question
1
  • Chrome canary (Beta) has TLS 1.3.
    – jwilleke
    Aug 6, 2017 at 21:20

2 Answers 2

Reset to default
7

This is probably not news, but since the TLS 1.3 RFC is still in DRAFT, you'll probably cause yourself compatibility headaches if you turn it on for a production server.

I would guess this is exactly what you're running up against: TLS 1.3 may exist in some places, but is probably not fully supported all the way through both the client and server stacks; either some component doesn't support it, or they support mis-matched versions of the 1.3 draft, and they and up agreeing on 1.2. Just a guess.

Also note that (as far as I'm aware) TLS 1.2 --> TLS 1.3 is more about performance improvements and simplifying the protocol than about security. While there are a lot of good changes in 1.3, there's no security need to be a bleeding-edge adopter.

Improve this answer
4
  • So should I leave TLS 1.3 enabled so that it will use this protocol when it becomes available or am I better off disabling it until I know it's available?
    – Guru Josh
    Aug 5, 2017 at 4:04
  • I don't think I can answer that for you, it will depend on the vendor (Microsoft in this case). When the TLS 1.3 spec is eventually finalized, will the libraries you have installed now be compatible with the rest of the world, or will you have to patch it / tweak config? There's probably no harm in leaving it enabled, but like all brand-new technologies, expect some bumps at the beginning.
    – Mike Ounsworth
    Aug 5, 2017 at 4:17
  • I'm sorry Mike, but I do not agree with your statement. If you define cipher suites that are based on TLS 1.3 there is no problem with doing that, as long as you have other suites defined too. Also in Microsoft Windows TLS 1.3 is not available in Schannel yet, although the cipher suites itself are available and therefore there is no goal with implementing. But if you do so (what I recommend) as soon as the Schannel update is comming, your server is immediately using the TLS 1.3 ciphers. Of course to do so, you have to put the TLS 1.3 cipher suites in top of the cipher suite order.
    – KrasseChecker
    Jul 18, 2018 at 6:39
  • 1
    Per Microsoft TLS 1.3 Support Reference published January 30, 2020: TLS 1.3 is also supported on Windows 1903 as of release of this article for **testing purposes only, not production environment**.
    – phbits
    Apr 8, 2020 at 21:51
5

TLS v1.3 does not exist in schannel (the Windows TLS library) yet, so it can neither be enabled, nor will it be able to cause any problems.

Your app will continue to use TLS v1.2, assuming that is the version negotiated by the client and the server in this scenario until a TLS v1.3 implementation is addded to schannel, it's been made available for the the OSes in question, and then installed on your machines.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .