{"id":336,"date":"2021-07-23T12:28:01","date_gmt":"2021-07-23T12:28:01","guid":{"rendered":"https:\/\/ssdsunucum.com\/blog\/how-to-configure-microsoft-windows-7-to-use-tls-version-1-2\/"},"modified":"2021-07-23T12:28:01","modified_gmt":"2021-07-23T12:28:01","slug":"how-to-configure-microsoft-windows-7-to-use-tls-version-1-2","status":"publish","type":"post","link":"https:\/\/ssdsunucum.com\/blog\/how-to-configure-microsoft-windows-7-to-use-tls-version-1-2\/","title":{"rendered":"How to Configure Microsoft Windows 7 to Use TLS Version 1.2"},"content":{"rendered":"<\/p>\n
\n
<\/div>\n
\n

Overview<\/h2>\n

This document explains how to configure your Microsoft Windows\u00ae 7 workstation and Microsoft Outlook\u00ae 2010 mail clients to use Transport Layer Security (TLS) protocol version 1.2.<\/p>\n

\n
Important:<\/div>\n
\n
    \n
  • \n

    We support TLS version 1.2.<\/p>\n

      \n
    • We strongly recommend that you enable TLSv1.2 on your server.<\/li>\n<\/ul>\n<\/li>\n
    • \n

      The instructions in this document only<\/strong> pertain to servers that run the Windows 7 operating system.<\/p>\n<\/li>\n

    • \n

      We strongly<\/strong> recommend that you do not<\/strong> adjust the cipher and protocol settings for the Exim and Dovecot services on Windows 7. Servers on this operating system fail PCI compliance scans because of unpatched security vulnerabilities that exist in the following mail clients:<\/p>\n

        \n
      • Outlook 2007.<\/li>\n
      • Outlook 2010.<\/li>\n<\/ul>\n<\/li>\n<\/ul><\/div>\n<\/div>\n

        Create registry keys<\/h2>\n

        Install Windows update<\/h3>\n

        You must<\/strong> download and install the KB3140245<\/code> Windows update from the Microsoft Update Catalog. This update will create the registry key paths in which you will create new registry keys. These registry keys will allow you to enable TLSv1.2 on your server.<\/p>\n

        After you download and install the update, you must<\/strong> restart your workstation for the changes to take effect.<\/p>\n

        Add a registry key for Windows HTTP services<\/h3>\n

        To add a registry key for Windows HTTP services, perform the following steps:<\/p>\n

          \n
        1. From the Windows Start<\/em> menu, enter regedit.exe<\/code> in the Search<\/em> text box.<\/li>\n
        2. Click regedit.exe<\/em> to open the Registry Editor<\/em>.<\/li>\n
        3. \n

          Navigate to the following registry path: <\/p>\n

          \n
          HKEY_LOCAL_MACHINE<\/span>SOFTWARE<\/span>Microsoft<\/span>Windows<\/span>CurrentVersion<\/span>Internet Settings<\/span><\/span><\/span><\/span><\/span><\/code><\/pre>\n<\/div>\n<\/li>\n
        4. \n
          Select the WinHttp<\/code> key.<\/p>\n<\/li>\n
        5. \n
          From the Menu bar, click Edit<\/em>, select New<\/em>, and click DWORD (32-bit)<\/em> Value.<\/p>\n
          \n
          Note:<\/div>\n
          \n        On 64-bit systems, click QWORD (64-bit) Value<\/em>.\n    <\/div>\n<\/div>\n<\/li>\n
        6. \n
          Enter DefaultSecureProtocols<\/code> as the DWORD<\/em> value\u2019s name.<\/p>\n<\/li>\n
        7. \n
          Right-click the file and select Modify<\/em> from the Context<\/em> menu.<\/p>\n<\/li>\n
        8. \n
          Enter A00<\/code> in the Value Data<\/em> text box and click OK<\/em>. <\/p>\n
          \n
          Important:<\/div>\n
          \n
          If your workstation runs on a 64-bit system, you must also perform steps 5-8 for the following key:
          \nHKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionInternet SettingsWinHttp<\/p>\n<\/p><\/div>\n<\/div>\n<\/li>\n<\/ol>\n
          Add a registry key for the TLS directories<\/h3>\n
          To add registry keys for TLS versions 1.1 and 1.2, perform the following steps:<\/p>\n
            \n
          1. \n
            Navigate to the following registry path: <\/p>\n
            \n
            HKEY_LOCAL_MACHINE<\/span>SYSTEM<\/span>CurrentControlSet<\/span>Control<\/span>SecurityProviders<\/span>SCHANNEL<\/span>Protocols<\/span>TLS 1.1<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/code><\/pre>\n<\/div>\n<\/li>\n
          2. \n
            Select the Client<\/code> key.<\/p>\n<\/li>\n
          3. \n
            From the Menu bar, click Edit<\/em>, select New<\/em>, and click DWORD (32-bit) Value<\/em>. <\/p>\n
            \n
            Remember:<\/div>\n
            \n        On 64-bit systems, click QWORD (64-bit) Value<\/em>.\n    <\/div>\n<\/div>\n<\/li>\n
          4. \n
            Enter DisabledByDefault<\/code> as the DWORD value\u2019s name.<\/p>\n<\/li>\n
          5. \n
            Right-click the file and select Modify<\/em> from the Context<\/em> menu.<\/p>\n<\/li>\n
          6. \n
            Enter 0<\/code> in the Value Data<\/em> text box and click OK<\/em>.<\/p>\n<\/li>\n
          7. \n
            Navigate to the TLS1.2 registry path and open the Client<\/em> key.<\/p>\n<\/li>\n
          8. \n
            Repeat steps 2-6 and click OK<\/em>.<\/p>\n<\/li>\n<\/ol>\n
            Apply the settings.<\/h3>\n
            After you modify your registry keys, you must<\/strong> restart your workstation to apply the registry settings. When your workstation restarts, create a test email account in Microsoft Outlook and configure the following settings in the Advanced<\/em> section of Microsoft Outlook\u2019s Internet E-Mail Settings<\/em> interface:<\/p>\n
              \n
            • Enter 993<\/code> in the Incoming Server (IMAP) text box or 995 in the Incoming Server (POP3) text box.<\/li>\n
            • Enter 465<\/code> in the Outgoing Server (SMTP) text box.<\/li>\n<\/ul>\n
              After you finish, click OK<\/em>. Your Microsoft Outlook account will now successfully connect to your cPanel server\u2019s mail services.<\/p>\n
              Installation scripts<\/h3>\n
              We created two scripts that will automatically perform the actions that this document describes. To use these scripts, perform the following steps:<\/p>\n
                \n
              1. Open the Windows PowerShell<\/em> application.<\/li>\n
              2. Navigate to the directory of you choice.<\/li>\n
              3. Create the install-kb.ps1<\/code> and tls-reg-edit.ps1<\/code> files.<\/li>\n
              4. \n
                Open the install-kb.ps1<\/code> file with a text editor and add the following information:<\/p>\n
                \n
                        Click to view…<\/p>\n
                \n
                \n
                \n
                Note:<\/div>\n
                \n        This script downloads and installs the KB3140245 Windows update.\n    <\/div>\n<\/div>\n
                \n
                \n\n\n
                \n
                 1\n<\/span> 2\n<\/span> 3\n<\/span> 4\n<\/span> 5\n<\/span> 6\n<\/span> 7\n<\/span> 8\n<\/span> 9\n<\/span>10\n<\/span>11\n<\/span>12\n<\/span>13\n<\/span>14\n<\/span>15\n<\/span>16\n<\/span><\/code><\/pre>\n<\/td>\n
                		\n
                Import<\/span>-<\/span>Module<\/span> BitsTransfer<\/span>\n\n$<\/span>arch<\/span>=(Get<\/span>-<\/span>WmiObject<\/span> -<\/span>Class<\/span> Win32_operatingsystem<\/span>).Osarchitecture<\/span>\n\nIf<\/span> ($<\/span>arch<\/span> -<\/span>eq<\/span> \"32-bit\"<\/span>) {\n    $<\/span>kbUrl32<\/span> = \"http:\/\/download.windowsupdate.com\/c\/msdownload\/update\/software\/updt\/2016\/04\/windows6.1-kb3140245-x86_cdafb409afbe28db07e2254f40047774a0654f18.msu\"<\/span>\n    $<\/span>kb32<\/span> = \"windows6.1-kb3140245-x86_cdafb409afbe28db07e2254f40047774a0654f18.msu\"<\/span>\n    Start<\/span>-<\/span>BitsTransfer<\/span> -<\/span>source<\/span> $<\/span>kbUrl32<\/span>\n    wusa<\/span> $<\/span>kb32<\/span> \/<\/span>log<\/span>:install<\/span>.log<\/span>\n}\nElse<\/span> {\n    $<\/span>kbUrl64<\/span> = \"http:\/\/download.windowsupdate.com\/c\/msdownload\/update\/software\/updt\/2016\/04\/windows6.1-kb3140245-x64_5b067ffb69a94a6e5f9da89ce88c658e52a0dec0.msu\"<\/span>\n    $<\/span>kb64<\/span> = \"windows6.1-kb3140245-x64_5b067ffb69a94a6e5f9da89ce88c658e52a0dec0.msu\"<\/span>\n    Start<\/span>-<\/span>BitsTransfer<\/span> -<\/span>source<\/span> $<\/span>kbUrl64<\/span>\n    wusa<\/span> $<\/span>kb64<\/span> \/<\/span>log<\/span>:install<\/span>.log<\/span>\n}<\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/div>\n<\/li>\n
              5. \n
                Open the tls-reg-edit.ps1<\/code> file with a text editor and add the following information:<\/p>\n
                \n
                        Click to view…<\/p>\n
                \n
                \n
                \n
                Note:<\/div>\n
                \n
                This script creates registry keys in the following files:<\/p>\n
                \n
                \n\n\n
                \n
                1\n<\/span>2\n<\/span>3\n<\/span>4\n<\/span><\/code><\/pre>\n<\/td>\n
                		\n
                HKEY_LOCAL_MACHINE<\/span><\/span>SOFTWARE<\/span><\/span>Microsoft<\/span><\/span>Windows<\/span><\/span>CurrentVersion<\/span><\/span>Internet<\/span> Settings<\/span><\/span>WinHttp<\/span>\nHKEY_LOCAL_MACHINE<\/span><\/span>SOFTWARE<\/span><\/span>Wow6432Node<\/span><\/span>Microsoft<\/span><\/span>Windows<\/span><\/span>CurrentVersion<\/span><\/span>Internet<\/span> Settings<\/span><\/span>WinHttp<\/span>\nHKEY_LOCAL_MACHINE<\/span><\/span>SYSTEM<\/span><\/span>CurrentControlSet<\/span><\/span>Control<\/span><\/span>SecurityProviders<\/span><\/span>SCHANNEL<\/span><\/span>Protocols<\/span><\/span>TLS<\/span> 1.1<\/span>\nHKEY_LOCAL_MACHINE<\/span><\/span>SYSTEM<\/span><\/span>CurrentControlSet<\/span><\/span>Control<\/span><\/span>SecurityProviders<\/span><\/span>SCHANNEL<\/span><\/span>Protocols<\/span><\/span>TLS<\/span> 1.2<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div><\/div>\n<\/div>\n
                \n
                \n\n\n
                \n
                 1\n<\/span> 2\n<\/span> 3\n<\/span> 4\n<\/span> 5\n<\/span> 6\n<\/span> 7\n<\/span> 8\n<\/span> 9\n<\/span>10\n<\/span>11\n<\/span>12\n<\/span>13\n<\/span>14\n<\/span>15\n<\/span>16\n<\/span>17\n<\/span>18\n<\/span>19\n<\/span>20\n<\/span>21\n<\/span>22\n<\/span>23\n<\/span>24\n<\/span>25\n<\/span>26\n<\/span>27\n<\/span>28\n<\/span>29\n<\/span>30\n<\/span>31\n<\/span>32\n<\/span>33\n<\/span>34\n<\/span>35\n<\/span>36\n<\/span>37\n<\/span>38\n<\/span>39\n<\/span>40\n<\/span>41\n<\/span>42\n<\/span>43\n<\/span>44\n<\/span>45\n<\/span>46\n<\/span>47\n<\/span>48\n<\/span>49\n<\/span>50\n<\/span>51\n<\/span>52\n<\/span>53\n<\/span>54\n<\/span><\/code><\/pre>\n<\/td>\n
                		\n
                $<\/span>arch<\/span>=(Get<\/span>-<\/span>WmiObject<\/span> -<\/span>Class<\/span> Win32_operatingsystem<\/span>).Osarchitecture<\/span>\n$<\/span>reg32bWinHttp<\/span> = \"HKLM:SOFTWAREMicrosoftWindowsCurrentVersionInternet SettingsWinHttp\"<\/span>\n$<\/span>reg64bWinHttp<\/span> = \"HKLM:SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionInternet SettingsWinHttp\"<\/span>\n$<\/span>regWinHttpDefault<\/span> = \"DefaultSecureProtocols\"<\/span>\n$<\/span>regWinHttpValue<\/span> = \"0x00000a00\"<\/span>\n$<\/span>regTLS11<\/span> = \"HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client\"<\/span>\n$<\/span>regTLS12<\/span> = \"HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client\"<\/span>\n$<\/span>regTLSDefault<\/span> = \"DisabledByDefault\"<\/span>\n$<\/span>regTLSValue<\/span> = \"0x00000000\"<\/span>\n\nClear<\/span>-<\/span>Host<\/span>\nWrite<\/span>-<\/span>Output<\/span> \"Creating Registry Keys...`n\"<\/span>\nWrite<\/span>-<\/span>Output<\/span> \"Creating registry key $reg32bWinHttp$regWinHttpDefault with value $regWinHttpValue\"<\/span>\n\nIF<\/span>(!(Test<\/span>-<\/span>Path<\/span> $<\/span>reg32bWinHttp<\/span>)) {\n    New<\/span>-<\/span>Item<\/span> -<\/span>Path<\/span> $<\/span>reg32bWinHttp<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n    New<\/span>-<\/span>ItemProperty<\/span> -<\/span>Path<\/span> $<\/span>reg32bWinHttp<\/span> -<\/span>Name<\/span> $<\/span>regWinHttpDefault<\/span> -<\/span>Value<\/span> $<\/span>regWinHttpValue<\/span> -<\/span>PropertyType<\/span> DWORD<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n}\nELSE<\/span> {\n    New<\/span>-<\/span>ItemProperty<\/span> -<\/span>Path<\/span> $<\/span>reg32bWinHttp<\/span> -<\/span>Name<\/span> $<\/span>regWinHttpDefault<\/span> -<\/span>Value<\/span> $<\/span>regWinHttpValue<\/span> -<\/span>PropertyType<\/span> DWORD<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n}\n\nIF<\/span>($<\/span>arch<\/span> -<\/span>eq<\/span> \"64-bit\"<\/span>) {\n    Write<\/span>-<\/span>Output<\/span> \"Creating registry key $reg64bWinHttp$regWinHttpDefault with value $regWinHttpValue\"<\/span>\n    IF<\/span>(!(Test<\/span>-<\/span>Path<\/span> $<\/span>reg64bWinHttp<\/span>)) {\n        New<\/span>-<\/span>Item<\/span> -<\/span>Path<\/span> $<\/span>reg64bWinHttp<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n        New<\/span>-<\/span>ItemProperty<\/span> -<\/span>Path<\/span> $<\/span>reg64bWinHttp<\/span> -<\/span>Name<\/span> $<\/span>regWinHttpDefault<\/span> -<\/span>Value<\/span> $<\/span>regWinHttpValue<\/span> -<\/span>PropertyType<\/span> DWORD<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n    }\n    ELSE<\/span> {\n        New<\/span>-<\/span>ItemProperty<\/span> -<\/span>Path<\/span> $<\/span>reg64bWinHttp<\/span> -<\/span>Name<\/span> $<\/span>regWinHttpDefault<\/span> -<\/span>Value<\/span> $<\/span>regWinHttpValue<\/span> -<\/span>PropertyType<\/span> DWORD<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n    }\n}\n\nWrite<\/span>-<\/span>Output<\/span> \"Creating registry key $regTLS11$regTLSDefault with value $regTLSValue\"<\/span>\n\nIF<\/span>(!(Test<\/span>-<\/span>Path<\/span> $<\/span>regTLS11<\/span>)) {\n    New<\/span>-<\/span>Item<\/span> -<\/span>Path<\/span> $<\/span>regTLS11<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n    New<\/span>-<\/span>ItemProperty<\/span> -<\/span>Path<\/span> $<\/span>regTLS11<\/span> -<\/span>Name<\/span> $<\/span>regTLSDefault<\/span> -<\/span>Value<\/span> $<\/span>regTLSValue<\/span> -<\/span>PropertyType<\/span> DWORD<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n    }\nELSE<\/span> {\n    New<\/span>-<\/span>ItemProperty<\/span> -<\/span>Path<\/span> $<\/span>regTLS11<\/span> -<\/span>Name<\/span> $<\/span>regTLSDefault<\/span> -<\/span>Value<\/span> $<\/span>regTLSValue<\/span> -<\/span>PropertyType<\/span> DWORD<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n}\n\nWrite<\/span>-<\/span>Output<\/span> \"Creating registry key $regTLS12$regTLSDefault with value $regTLSValue\"<\/span>\n\nIF<\/span>(!(Test<\/span>-<\/span>Path<\/span> $<\/span>regTLS12<\/span>)) {\n    New<\/span>-<\/span>Item<\/span> -<\/span>Path<\/span> $<\/span>regTLS12<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n    New<\/span>-<\/span>ItemProperty<\/span> -<\/span>Path<\/span> $<\/span>regTLS12<\/span> -<\/span>Name<\/span> $<\/span>regTLSDefault<\/span> -<\/span>Value<\/span> $<\/span>regTLSValue<\/span> -<\/span>PropertyType<\/span> DWORD<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n    }\nELSE<\/span> {\n    New<\/span>-<\/span>ItemProperty<\/span> -<\/span>Path<\/span> $<\/span>regTLS12<\/span> -<\/span>Name<\/span> $<\/span>regTLSDefault<\/span> -<\/span>Value<\/span> $<\/span>regTLSValue<\/span> -<\/span>PropertyType<\/span> DWORD<\/span> -<\/span>Force<\/span> | Out<\/span>-<\/span>Null<\/span>\n}\n\nWrite<\/span>-<\/span>Output<\/span> \"`nComplete!\"<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/div>\n<\/li>\n
              6. \n
                Run the scripts from the directory in which you saved the files, for example: <\/p>\n
                \n
                \n\n\n
                \n
                1\n<\/span>2\n<\/span><\/code><\/pre>\n<\/td>\n
                		\n
                Set<\/span>-<\/span>ExecutionPolicy<\/span> Bypass<\/span> -<\/span>Scope<\/span> Process<\/span> ; .<\/span>install<\/span>-<\/span>kb<\/span>.ps1<\/span>\nSet<\/span>-<\/span>ExecutionPolicy<\/span> Bypass<\/span> -<\/span>Scope<\/span> Process<\/span> ; .<\/span>tls<\/span>-<\/span>reg<\/span>-<\/span>edit<\/span>.ps1<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n<\/li>\n
              7. \n
                Restart your workstation for the changes to take effect.<\/p>\n<\/li>\n<\/ol><\/div>\n","protected":false},"excerpt":{"rendered":"
                Overview This document explains how to configure your Microsoft Windows\u00ae 7 workstation and Microsoft Outlook\u00ae 2010 mail clients to use Transport Layer Security (TLS) protocol version 1.2. Important: We support TLS version 1.2. We strongly recommend that you enable TLSv1.2 on your server. The instructions in this document only pertain to servers that run the …<\/p>\n","protected":false},"author":1,"featured_media":337,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/336"}],"collection":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/comments?post=336"}],"version-history":[{"count":0,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/336\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media\/337"}],"wp:attachment":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media?parent=336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/categories?post=336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/tags?post=336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}