How to Disable TLS 1.0 and 1.1 in Windows Registry

This article outlines the specific Windows Registry keys used to deprecate and disable Transport Layer Security (TLS) versions 1.0 and 1.1. Disabling these outdated cryptographic protocols protects systems against modern vulnerabilities and enforces the use of more secure protocols like TLS 1.2 and TLS 1.3.

Registry Location

In the Windows Registry Editor (regedit), the activation and deprecation of TLS protocols are controlled under the SCHANNEL configuration path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Required Subkeys and Values

To fully disable TLS 1.0 and TLS 1.1 for both incoming and outgoing connections, separate subkeys must be configured for the client and server roles within the Protocols key.

1. Disabling TLS 1.0

Navigate to or create the following paths: * HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client * HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server

Inside both the Client and Server keys, create or modify the following DWORD (32-bit) Values:

• Enabled: Set the value to 0 (Hexadecimal)
• DisabledByDefault: Set the value to 1 (Hexadecimal)

2. Disabling TLS 1.1

Navigate to or create the following paths: * HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client * HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server

Inside both the Client and Server keys, create or modify the following DWORD (32-bit) Values:

• Enabled: Set the value to 0 (Hexadecimal)
• DisabledByDefault: Set the value to 1 (Hexadecimal)

Applying Changes

After creating or modifying these registry keys, restart the Windows machine to ensure the SCHANNEL security provider reloads its configuration and stops accepting connections via TLS 1.0 and TLS 1.1.