How to Enforce TLS 1.3 via Windows Regedit

This guide explains how to strictly enforce Transport Layer Security (TLS) 1.3 on Windows systems using the Registry Editor (Regedit). By configuring the Secure Channel (Schannel) registry keys, you can enable TLS 1.3 for both client and server endpoints while simultaneously disabling legacy protocols such as TLS 1.0, TLS 1.1, and TLS 1.2 to achieve strict cryptographic compliance.

Prerequisites

Step 1: Open the Registry Editor

  1. Press Win + R to open the Run dialog box.
  2. Type regedit and press Enter.
  3. Confirm the User Account Control (UAC) prompt by selecting Yes.

Step 2: Navigate to the Protocols Key

In the Registry Editor address bar, navigate to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Step 3: Create and Enable TLS 1.3 Keys

Under the Protocols folder, you must define keys for both the Client and Server roles.

  1. Right-click the Protocols key, select New > Key, and name it TLS 1.3.
  2. Right-click TLS 1.3, select New > Key, and name it Client.
  3. Right-click TLS 1.3 again, select New > Key, and name it Server.

Inside both the Client and Server keys, create the following two DWORD (32-bit) values:

Step 4: Disable Legacy Protocols for Strict Enforcement

To enforce strict TLS 1.3, all older protocols must be explicitly disabled to prevent fallback negotiations.

Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols, create or modify keys for TLS 1.2, TLS 1.1, TLS 1.0, SSL 3.0, and SSL 2.0.

Inside each protocol’s Client and Server subkeys, set the following values:

Step 5: Restart the System

Registry modifications to the Schannel security provider do not take effect dynamically. Reboot the operating system to apply the new cryptographic settings:

  1. Save any open work.
  2. Restart the machine.

Once rebooted, the system will strictly negotiate outbound and inbound secure connections using the TLS 1.3 protocol.