Find Legacy SSL Cryptographic Providers in Regedit

This article explains how to locate the list of registered Cryptographic Service Providers (CSPs) used by legacy SSL protocols in the Windows Registry. Windows utilizes the CryptoAPI architecture to manage CSPs that handle cryptographic algorithms for legacy Schannel communications. Below, you will find the exact registry paths, key components, and steps needed to navigate to these settings using the Registry Editor (regedit.exe).

Primary Registry Path for Cryptographic Service Providers

The complete list of all registered Cryptographic Service Providers installed on a Windows system is located under the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider

For 32-bit applications running on a 64-bit version of Windows, the 32-bit provider configurations are mapped under:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Defaults\Provider

Specific CSPs Used for Legacy SSL/TLS Protocols

Legacy versions of SSL (such as SSL 2.0 and SSL 3.0) and early TLS implementations implemented via Microsoft’s Security Support Provider (Schannel) rely primarily on specific Schannel CSPs. Under the Provider key, you will see subkeys corresponding to each registered provider:

• Microsoft RSA SChannel Cryptographic Provider: Handles RSA-based key exchange, encryption, and digital signatures for legacy SSL/TLS sessions.
• Microsoft DH SChannel Cryptographic Provider: Handles Diffie-Hellman key exchanges for legacy SSL/TLS connections.

Each subkey contains values defining the provider’s binary file (the Image Path), the Type ID (such as Type 12 for RSA SChannel), and signature validation data.

Provider Types Path

To view how specific provider types map to default CSPs, navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types

• Type 012: Corresponds to PROV_RSA_SCHANNEL (RSA Schannel provider).
• Type 014: Corresponds to PROV_DH_SCHANNEL (Diffie-Hellman Schannel provider).

Associated Schannel Protocol and Cipher Settings

While the providers themselves reside under the Cryptography tree, the protocol-level controls that determine whether legacy SSL protocols and ciphers can actively use these providers are located at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Within this key: * Protocols: Contains subkeys for SSL 2.0, SSL 3.0, TLS 1.0, etc., where Client and Server subkeys dictate Enabled and DisabledByDefault flags. * Ciphers, Hashes, and KeyExchangeAlgorithms: Define which cryptographic algorithms are permitted to execute through the registered providers.

How to View These Keys

1. Press Win + R, type regedit, and press Enter.
2. Paste HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider into the address bar at the top.
3. Expand the folder to view and inspect all legacy SSL and CryptoAPI providers installed on the system.