I've got a Windows 2008 R2 server with both TLS 1.1 and TLS 1.2 enabled (but TLS 1.0 disabled) in the registry. In other words, Enabled = 0xffffffff and DisabledByDefault = 0 under both the Client and Server subkeys of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 and TLS 1.2; both values are 0 for TLS 1.0.

IISCrypto confirms this configuration.

However, when I scan an IIS-based website on the server using Qualys SSL Labs, it reports that the server is supporting only TLS 1.2--which is is my goal, but I don't understand how this has happened, given that I haven't disabled TLS 1.1 in the registry. What can be causing SSL Labs to fail to establish communication with the website over TLS 1.1?

  • Try double checking your config with the free “iiscrypto” tool. Then try running a local scan. E.g using the free “testssl.sh” tool. – StackzOfZtuff Mar 8 '18 at 19:49
  • See my post again. I did use iiscrypto. I'll look into testssl, thanks. – Green Grasso Holm Mar 8 '18 at 19:56
  • Is it possible there is a WAF or load balancer preventing TLS 1.1 connections? – k1DBLITZ Mar 9 '18 at 5:41
  • Apparently there isn't one. We haven't managed to get any clarity yet as to what it could be. An idea I had is that maybe our server doesn't support any of the ciphers that's compatible with TLS 1.1, so that TLS 1.1 is effectively disabled even if we don't have it formally switched off. I don't know whether that's a possible scenario. – Green Grasso Holm Mar 12 '18 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.