Enforce TLS 1.3 in Windows Registry via Regedit

This guide explains how to enforce TLS 1.3 as the default secure communication protocol on Windows operating systems using the Registry Editor (Regedit). By configuring specific registry subkeys within the Schannel security provider, you can enable TLS 1.3 for both client and server roles, enhancing cryptographic security and network performance across supported Windows 11 and Windows Server 2022 environments.

Step 1: Open the Registry Editor

  1. Press Win + R to open the Run dialog box.
  2. Type regedit and press Enter (or click OK).
  3. Click Yes when prompted by User Account Control (UAC).

Step 2: Navigate to the Protocols Key

In the Registry Editor address bar, navigate to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Step 3: Create the TLS 1.3 Key Hierarchy

If the TLS 1.3 keys do not already exist, you must create them:

  1. Right-click on the Protocols folder, select New > Key, and name it TLS 1.3.
  2. Right-click on the newly created TLS 1.3 key, select New > Key, and name it Client.
  3. Right-click again on the TLS 1.3 key, select New > Key, and name it Server.

Step 4: Add and Configure DWORD Values

You must create two DWORD (32-bit) Values under both the Client and Server subkeys.

For the Client Key:

  1. Select the Client key.
  2. In the right pane, right-click, select New > DWORD (32-bit) Value, and name it DisabledByDefault. Set its value to 0 (Hexadecimal).
  3. Right-click again, select New > DWORD (32-bit) Value, and name it Enabled. Set its value to 1 (Hexadecimal).

For the Server Key:

  1. Select the Server key.
  2. In the right pane, right-click, select New > DWORD (32-bit) Value, and name it DisabledByDefault. Set its value to 0 (Hexadecimal).
  3. Right-click again, select New > DWORD (32-bit) Value, and name it Enabled. Set its value to 1 (Hexadecimal).

Step 5: (Optional) Disable Legacy TLS Protocols

To strictly enforce TLS 1.3 and prevent fallbacks to insecure protocols, ensure older versions (TLS 1.0, TLS 1.1) are disabled under Protocols:

  1. Under Protocols, create keys for TLS 1.0 and TLS 1.1 (with Client and Server subkeys for each).
  2. Inside the Client and Server subkeys of each legacy version, set:
    • Enabled = 0 (DWORD)
    • DisabledByDefault = 1 (DWORD)

Step 6: Restart the System

Close the Registry Editor and restart your computer or server to apply the changes to the Windows Schannel security provider. Once rebooted, Windows will default to TLS 1.3 for secure handshakes whenever supported by the remote host.