Skip to content
WinBookUnofficial

Windows TLS hardening: Schannel, cipher suites and safe rollback

Verified 1 min read

Harden IIS/Nginx TLS on Windows with TLS 1.2/1.3, deliberate cipher suites, a registry backup and client testing before disabling old protocols.

Tested onStandard / Datacenter · Build 26100.33650 · x64
E1
Build
26100.33650
Edition
Standard / Datacenter
Architecture
x64
Support
Documentation (E1)
Evidence
E1Official documentation
Verified
2026-10-29
Page type
Task

The short answer

Section titled “The short answer”

Windows TLS is Schannel; IIS/HTTP.sys and many services use it. Harden deliberately:

  1. Inventory clients and protocols.
  2. Enable TLS 1.2/1.3; disable TLS 1.0/1.1 only after client testing.
  3. Remove known-weak cipher suites; prefer ECDHE + AES-GCM/ChaCha20.
  4. Back up the registry before changes.
  5. Test with openssl s_client and a real client matrix.

Do not paste a random “perfect TLS” registry file into production.

Check what is offered

Section titled “Check what is offered”
Terminal window
Get-TlsCipherSuite | Select-Object Name,Protocol
openssl s_client -connect lab.example:443 -servername lab.example -tls1_2
openssl s_client -connect lab.example:443 -servername lab.example -tls1_3

openssl output shows the negotiated protocol/cipher. For an external view, use a TLS scanner; do not rely only on a browser padlock.

Protocols

Section titled “Protocols”

Registry paths (machine policy):

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server

Typical hardening: Enabled=0, DisabledByDefault=1 for old protocols; Enabled=1, DisabledByDefault=0 for 1.2/1.3. A reboot is usually required for Schannel changes.

Back up first:

Terminal window
reg export "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" C:\backup\schannel.reg

Cipher suites

Section titled “Cipher suites”
Terminal window
Get-TlsCipherSuite | Sort-Object Name
Disable-TlsCipherSuite -Name 'TLS_RSA_WITH_3DES_EDE_CBC_SHA'

Prefer ECDHE + AES-GCM/ChaCha20. Do not disable every CBC suite if a legacy client still needs one; document the exception. Cipher order can matter for older clients.

IIS and Nginx

Section titled “IIS and Nginx”
  • IIS uses Schannel; the site binding only chooses the certificate.
  • Nginx uses OpenSSL, not Schannel. Windows Nginx TLS is governed by ssl_protocols/ssl_ciphers, not the registry.
  • If IIS and Nginx share a host, harden both separately.

Verify before and after

Section titled “Verify before and after”
Terminal window
# before
openssl s_client -connect lab.example:443 -servername lab.example -tls1_2 </dev/null
# after
curl.exe -I https://lab.example/

Test at least: current Chrome/Edge, a mobile client, an API client, and any legacy device you must support.

Lab boundary

Section titled “Lab boundary”

E1. The lab used a self-signed certificate for WAC and did not change Schannel. The registry/cipher steps are the hardening plan to validate on Server 2025.

Sources