TLS-SSL-Protocols - Revision history

Stevenlawrance: /* Configure Without Group Policies */

2015-12-07T01:37:48Z

Configure Without Group Policies

← Older revision		Revision as of 01:37, 7 December 2015
Line 115:		Line 115:
	==Configure Without Group Policies==		==Configure Without Group Policies==
	To quickly configure a computer that doesn't have group policies, it is possible to use a registry merge file. The following files implement their stated configuration scenarios:		To quickly configure a computer that doesn't have group policies, it is possible to use a registry merge file. The following files implement their stated configuration scenarios:
	*[https://www.moonlightdesign.org/dl/~~TLS~~-~~SSL-Recommended~~.reg Recommended: TLS 1.2, 1.1, and 1.0]		*[https://www.moonlightdesign.org/dl/TLS1-1.2.reg Recommended: TLS 1.2, 1.1, and 1.0]
	**Compatible with all versions of Windows that implement TLS 1.0, including those that don't implement TLS 1.1 and 1.2.		**Compatible with all versions of Windows that implement TLS 1.0, including those that don't implement TLS 1.1 and 1.2.
	*[https://www.moonlightdesign.org/dl/~~TLS-SSL-Windows-7-Best~~.reg Windows 7 Best Security: TLS 1.2 only]		*[https://www.moonlightdesign.org/dl/TLS1.2.reg Windows 7 Best Security: TLS 1.2 only]
	**A ~~significant~~ number of web sites on the Internet won't work ~~at this time~~ with this configuration.		**A shrinking number of web sites on the Internet won't work with this configuration.
	**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file. Internet Explorer 11 doesn't start in Windows 8 when TLS 1.0 is disabled in Schannel.		*[https://www.moonlightdesign.org/dl/TLS1-1.2.reg Windows 7 Good Security: TLS 1.2 and 1.1]
	*[https://www.moonlightdesign.org/dl/~~TLS~~-~~SSL-Windows-7-Good~~.reg Windows 7 Good Security: TLS 1.2 and 1.1]		**A shrinking number of web sites on the Internet won't work with this configuration.
	**A ~~significant~~ number of web sites on the Internet won't work ~~at this time~~ with this configuration.
	**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file. Internet Explorer 11 doesn't start in Windows 8 when TLS 1.0 is disabled in Schannel.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-Vista-XP.reg Windows Vista/XP: TLS 1.0 Only]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-Vista-XP.reg Windows Vista/XP: TLS 1.0 Only]
	**Don't use this on Windows 7, Windows Server 2008 R2, or newer as it disables TLS 1.1 and TLS 1.2 in Internet Explorer.		**Don't use this on Windows 7, Windows Server 2008 R2, or newer as it disables TLS 1.1 and TLS 1.2 in Internet Explorer.

Stevenlawrance: /* Configure Without Group Policies */

2014-10-20T13:40:49Z

Configure Without Group Policies

← Older revision		Revision as of 13:40, 20 October 2014
Line 126:		Line 126:
	**Don't use this on Windows 7, Windows Server 2008 R2, or newer as it disables TLS 1.1 and TLS 1.2 in Internet Explorer.		**Don't use this on Windows 7, Windows Server 2008 R2, or newer as it disables TLS 1.1 and TLS 1.2 in Internet Explorer.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]
	**Don't use this unless if absolutely necessary. This configuration opens up your https connections to attack and should be equivalent to having no encryption.		**Don't use this unless if absolutely necessary. This configuration opens up your https connections to attack and should be considered equivalent to having no encryption.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]
	**Don't use this unless if absolutely necessary. This configuration opens up your https connections to attack and should be equivalent to having no encryption.		**Don't use this unless if absolutely necessary. This configuration opens up your https connections to attack and should be considered equivalent to having no encryption.
	**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file.		**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file.

Stevenlawrance: /* Configure Without Group Policies */

2014-10-20T13:39:45Z

Configure Without Group Policies

← Older revision		Revision as of 13:39, 20 October 2014
Line 118:		Line 118:
	**Compatible with all versions of Windows that implement TLS 1.0, including those that don't implement TLS 1.1 and 1.2.		**Compatible with all versions of Windows that implement TLS 1.0, including those that don't implement TLS 1.1 and 1.2.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-7-Best.reg Windows 7 Best Security: TLS 1.2 only]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-7-Best.reg Windows 7 Best Security: TLS 1.2 only]
			**A significant number of web sites on the Internet won't work at this time with this configuration.
	**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file. Internet Explorer 11 doesn't start in Windows 8 when TLS 1.0 is disabled in Schannel.		**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file. Internet Explorer 11 doesn't start in Windows 8 when TLS 1.0 is disabled in Schannel.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-7-Good.reg Windows 7 Good Security: TLS 1.2 and 1.1]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-7-Good.reg Windows 7 Good Security: TLS 1.2 and 1.1]
			**A significant number of web sites on the Internet won't work at this time with this configuration.
	**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file. Internet Explorer 11 doesn't start in Windows 8 when TLS 1.0 is disabled in Schannel.		**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file. Internet Explorer 11 doesn't start in Windows 8 when TLS 1.0 is disabled in Schannel.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-Vista-XP.reg Windows Vista/XP: TLS 1.0 Only]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-Vista-XP.reg Windows Vista/XP: TLS 1.0 Only]
			**Don't use this on Windows 7, Windows Server 2008 R2, or newer as it disables TLS 1.1 and TLS 1.2 in Internet Explorer.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]
			**Don't use this unless if absolutely necessary. This configuration opens up your https connections to attack and should be equivalent to having no encryption.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]
			**Don't use this unless if absolutely necessary. This configuration opens up your https connections to attack and should be equivalent to having no encryption.
	**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file.		**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file.

Stevenlawrance: /* Configure With Group Policies */

2014-10-18T22:54:09Z

Configure With Group Policies

← Older revision		Revision as of 22:54, 18 October 2014
Line 59:		Line 59:
	[[File:Policies-Computer-SSLv3Client.png\|650px]]		[[File:Policies-Computer-SSLv3Client.png\|650px]]

	If your network is comprised entirely of Windows Server 2008 R2, Windows 7, or newer operating systems, then disabling TLS 1.0 can improve security further, ~~though the author of~~ this ~~template hasn~~'t ~~yet tried disabling~~ TLS 1.0 ~~at the computer level~~ in ~~such~~ a ~~network~~.		If your network is comprised entirely of Windows Server 2008 R2, Windows 7, or newer operating systems, then disabling TLS 1.0 can theoretically improve security further, but when this was tested in Windows 8 with Internet Explorer 11, Internet Explorer 11 wouldn't start up successfully until TLS 1.0 was enabled in Schannel. As a result, TLS 1.0 will need to be left enabled in Windows Schannel, even if it's disabled in Internet Explorer.

	===User Policy===		===User Policy===

Stevenlawrance: /* Configure Without Group Policies */

2014-10-18T22:47:18Z

Configure Without Group Policies

← Older revision		Revision as of 22:47, 18 October 2014
Line 118:		Line 118:
	**Compatible with all versions of Windows that implement TLS 1.0, including those that don't implement TLS 1.1 and 1.2.		**Compatible with all versions of Windows that implement TLS 1.0, including those that don't implement TLS 1.1 and 1.2.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-7-Best.reg Windows 7 Best Security: TLS 1.2 only]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-7-Best.reg Windows 7 Best Security: TLS 1.2 only]
			**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file. Internet Explorer 11 doesn't start in Windows 8 when TLS 1.0 is disabled in Schannel.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-7-Good.reg Windows 7 Good Security: TLS 1.2 and 1.1]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-7-Good.reg Windows 7 Good Security: TLS 1.2 and 1.1]
			**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file. Internet Explorer 11 doesn't start in Windows 8 when TLS 1.0 is disabled in Schannel.
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-Vista-XP.reg Windows Vista/XP: TLS 1.0 Only]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-Vista-XP.reg Windows Vista/XP: TLS 1.0 Only]
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]
	**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file.		**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file.

Stevenlawrance: /* Configure Without Group Policies */

2014-10-18T22:23:37Z

Configure Without Group Policies

← Older revision		Revision as of 22:23, 18 October 2014
Line 122:		Line 122:
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]
	**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer in this file.		**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer with this file.

Stevenlawrance at 22:23, 18 October 2014

2014-10-18T22:23:17Z

← Older revision		Revision as of 22:23, 18 October 2014
Line 122:		Line 122:
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]
	*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]		*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]
			**TLS 1.0 remains enabled in Windows Schannel, but it's off in Internet Explorer in this file.

Stevenlawrance at 22:15, 18 October 2014

2014-10-18T22:15:02Z

← Older revision		Revision as of 22:15, 18 October 2014
Line 7:		Line 7:
	Please note that Microsoft has a group policy setting for disabling TLS/SSL protocols in Internet Explorer, as described in the "Disable SSL 3.0 and enable TLS 1.0, TLS 1.1, and TLS 1.2 for Internet Explorer in Group Policy" section of [https://technet.microsoft.com/en-us/library/security/3009008.aspx#sectionToggle3 their recommendations], but it doesn't work reliably with Internet Explorer 6 or 7. As a result, Microsoft noted in their policy template that it works only with Internet Explorer 8 and higher. If you run Internet Explorer 6 or 7, then the group policy template described on this page is a tenable option for you. The computer policies in this policy template are also useful to IT administrators whom are targeting only Internet Explorer 8 or higher.		Please note that Microsoft has a group policy setting for disabling TLS/SSL protocols in Internet Explorer, as described in the "Disable SSL 3.0 and enable TLS 1.0, TLS 1.1, and TLS 1.2 for Internet Explorer in Group Policy" section of [https://technet.microsoft.com/en-us/library/security/3009008.aspx#sectionToggle3 their recommendations], but it doesn't work reliably with Internet Explorer 6 or 7. As a result, Microsoft noted in their policy template that it works only with Internet Explorer 8 and higher. If you run Internet Explorer 6 or 7, then the group policy template described on this page is a tenable option for you. The computer policies in this policy template are also useful to IT administrators whom are targeting only Internet Explorer 8 or higher.

	To handle systems that are not covered by group policies, this page includes registry merge files.		To handle systems that are not covered by group policies, this page also includes registry merge files for convenience.

	==Configure With Group Policies==		==Configure With Group Policies==
Line 115:		Line 115:
	==Configure Without Group Policies==		==Configure Without Group Policies==
	To quickly configure a computer that doesn't have group policies, it is possible to use a registry merge file. The following files implement their stated configuration scenarios:		To quickly configure a computer that doesn't have group policies, it is possible to use a registry merge file. The following files implement their stated configuration scenarios:
	*Recommended: TLS 1.2, 1.1, and 1.0		*[https://www.moonlightdesign.org/dl/TLS-SSL-Recommended.reg Recommended: TLS 1.2, 1.1, and 1.0]
	**Compatible with all versions of Windows that implement TLS 1.0, including those that don't implement TLS 1.1 and 1.2.		**Compatible with all versions of Windows that implement TLS 1.0, including those that don't implement TLS 1.1 and 1.2.
	*Windows 7 Best Security: TLS 1.2 only		*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-7-Best.reg Windows 7 Best Security: TLS 1.2 only]
	*Windows 7 Good Security: TLS 1.2 and 1.1		*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-7-Good.reg Windows 7 Good Security: TLS 1.2 and 1.1]
	*Windows Vista/XP: TLS 1.0 Only		*[https://www.moonlightdesign.org/dl/TLS-SSL-Windows-Vista-XP.reg Windows Vista/XP: TLS 1.0 Only]
	*Insecure: SSL 3.0 and TLS 1.0		*[https://www.moonlightdesign.org/dl/TLS-SSL-Insecure.reg Insecure: SSL 3.0 and TLS 1.0]
	*Highly Insecure: SSL 3.0 only		*[https://www.moonlightdesign.org/dl/TLS-SSL-Highly-Insecure.reg Highly Insecure: SSL 3.0 only]

Stevenlawrance at 22:03, 18 October 2014

2014-10-18T22:03:48Z

← Older revision		Revision as of 22:03, 18 October 2014
Line 9:		Line 9:
	To handle systems that are not covered by group policies, this page includes registry merge files.		To handle systems that are not covered by group policies, this page includes registry merge files.

	==~~Include in a~~ Group ~~Policy~~==		==Configure With Group Policies==
	To use the group policies, you'll need to install the policy template file. The policy template includes two group policy targets for configuration: Computer and User.		To use the group policies, you'll need to install the policy template file. The policy template includes two group policy targets for configuration: Computer and User.

Stevenlawrance at 22:03, 18 October 2014

2014-10-18T22:03:23Z

← Older revision		Revision as of 22:03, 18 October 2014
Line 7:		Line 7:
	Please note that Microsoft has a group policy setting for disabling TLS/SSL protocols in Internet Explorer, as described in the "Disable SSL 3.0 and enable TLS 1.0, TLS 1.1, and TLS 1.2 for Internet Explorer in Group Policy" section of [https://technet.microsoft.com/en-us/library/security/3009008.aspx#sectionToggle3 their recommendations], but it doesn't work reliably with Internet Explorer 6 or 7. As a result, Microsoft noted in their policy template that it works only with Internet Explorer 8 and higher. If you run Internet Explorer 6 or 7, then the group policy template described on this page is a tenable option for you. The computer policies in this policy template are also useful to IT administrators whom are targeting only Internet Explorer 8 or higher.		Please note that Microsoft has a group policy setting for disabling TLS/SSL protocols in Internet Explorer, as described in the "Disable SSL 3.0 and enable TLS 1.0, TLS 1.1, and TLS 1.2 for Internet Explorer in Group Policy" section of [https://technet.microsoft.com/en-us/library/security/3009008.aspx#sectionToggle3 their recommendations], but it doesn't work reliably with Internet Explorer 6 or 7. As a result, Microsoft noted in their policy template that it works only with Internet Explorer 8 and higher. If you run Internet Explorer 6 or 7, then the group policy template described on this page is a tenable option for you. The computer policies in this policy template are also useful to IT administrators whom are targeting only Internet Explorer 8 or higher.

	~~==Installation==~~		To handle systems that are not covered by group policies, this page includes registry merge files.
	Save the [https://www.moonlightdesign.org/dl/TLS-SSL-Protocols.adm Windows Server 2003 compatible policy template] as TLS-SSL-Protocols.adm within your Windows INF folder. This is typically <code>C:\Windows\INF</code>.

	==Include in a Group Policy==		==Include in a Group Policy==
	~~This~~ policy template includes two group policy targets: Computer and User.		To use the group policies, you'll need to install the policy template file. The policy template includes two group policy targets for configuration: Computer and User.

			===Installation===
			Save the [https://www.moonlightdesign.org/dl/TLS-SSL-Protocols.adm Windows Server 2003 compatible policy template] as TLS-SSL-Protocols.adm within your Windows INF folder. This is typically <code>C:\Windows\INF</code>.

	===Computer Policies===		===Computer Policies===
Line 110:		Line 112:

	Please note that users can update this setting within Internet Explorer's configuration options. This policy won't overwrite their customizations unless if this policy is changed to another value or if all policies are reapplied to that user, such as with 'gpupdate /force'.		Please note that users can update this setting within Internet Explorer's configuration options. This policy won't overwrite their customizations unless if this policy is changed to another value or if all policies are reapplied to that user, such as with 'gpupdate /force'.

			==Configure Without Group Policies==
			To quickly configure a computer that doesn't have group policies, it is possible to use a registry merge file. The following files implement their stated configuration scenarios:
			*Recommended: TLS 1.2, 1.1, and 1.0
			**Compatible with all versions of Windows that implement TLS 1.0, including those that don't implement TLS 1.1 and 1.2.
			*Windows 7 Best Security: TLS 1.2 only
			*Windows 7 Good Security: TLS 1.2 and 1.1
			*Windows Vista/XP: TLS 1.0 Only
			*Insecure: SSL 3.0 and TLS 1.0
			*Highly Insecure: SSL 3.0 only