configure SSL/TLS settings via Registry using GPO, follow these steps: Print

To configure SSL/TLS settings via Registry using GPO, follow these steps:

Step 1: Open Group Policy Management

1. Press Win + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.
   • If using a domain environment, open Group Policy Management Editor (gpmc.msc) and create or edit an existing GPO.

Step 2: Modify SSL/TLS Settings via Registry using GPO

Since SSL/TLS settings are controlled via the Windows Registry, we will use Group Policy Preferences to apply these registry changes.

1. Navigate to the Registry Settings in GPO

• In Group Policy Management Editor, go to:
   

  Computer Configuration > Preferences > Windows Settings > Registry
• Right-click and select New > Registry Item.

Step 3: Add Registry Keys for SSL/TLS

We will modify Schannel (Secure Channel) settings.

1. Disable TLS 1.0 & 1.1

For TLS 1.0

• Path:

   

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
  • Value Name: Enabled
  • Value Type: REG_DWORD
  • Value Data: 0 (Disabled)

• Path:

   

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
  • Value Name: Enabled
  • Value Type: REG_DWORD
  • Value Data: 0 (Disabled)

For TLS 1.1

• Path:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
  • Value Name: Enabled
  • Value Type: REG_DWORD
  • Value Data: 0 (Disabled)

• Path:

   

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client
  • Value Name: Enabled
  • Value Type: REG_DWORD
  • Value Data: 0 (Disabled)

2. Enable TLS 1.2 & TLS 1.3

For TLS 1.2

• Path:

   

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
  • Value Name: Enabled
  • Value Type: REG_DWORD
  • Value Data: 1 (Enabled)

• Path:

   

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client
  • Value Name: Enabled
  • Value Type: REG_DWORD
  • Value Data: 1 (Enabled)

For TLS 1.3

• Path:

   

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server
  • Value Name: Enabled
  • Value Type: REG_DWORD
  • Value Data: 1 (Enabled)

• Path:

   

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client
  • Value Name: Enabled
  • Value Type: REG_DWORD
  • Value Data: 1 (Enabled)

3. Configure SSL Cipher Suites (Optional)

To define SSL/TLS cipher suites, modify the following registry key:

• Path:
   

  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
  • Value Name: Functions
  • Value Type: REG_SZ
  • Value Data: (Example for TLS 1.2 and TLS 1.3)
    plaintext

     

    TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

Step 4: Apply and Enforce GPO

1. Close Group Policy Management Editor.
2. Run the following command to apply the policy:
   cmd

    

   gpupdate /force
3. Restart the computers for the settings to take effect.

Step 5: Verify SSL/TLS Configuration

To check if the settings are applied correctly:

PowerShell: Check Enabled TLS Versions

Open PowerShell (Admin) and run:

It should return:

PowerShell: Check Available Cipher Suites

Run:

This will display the enabled cipher suites.

Conclusion

Now, your system is hardened by: ✅ Disabling weak TLS 1.0 & TLS 1.1
✅ Enabling TLS 1.2 & TLS 1.3
✅ Configuring strong cipher suites via Registry using GPO

This method ensures secure encryption settings are enforced across all systems in your domain.