Manage SSL/TLS protocols and cipher suites for AD FS (2024)

Article
06/06/2023

The following documentation provides information on how to disable and enable certain TLS/SSL protocols and cipher suites that Active Directory Federation Services (AD FS) uses.

TLS/SSL, Schannel, and cipher suites in AD FS

The Transport Layer Security (TLS) protocol provides for encrypted secure communications over the network. The Secure Sockets Layer (SSL) protocol encrypts sensitive data exchanges transmitted between a web server and a web browser similar to TLS. Active Directory Federation Services (AD FS) uses these protocols for communications. Today, several versions of these protocols exist.

Security Channel (Schannel) is a Security Support Provider (SSP) that implements the SSL, TLS, and DTLS internet standard authentication protocols. The Security Support Provider Interface (SSPI) is an API used by Windows systems to perform security-related functions including authentication. The SSPI functions as a common interface to several SSPs, including the Schannel SSP.

A cipher suite is a set of cryptographic algorithms. The Schannel SSP implementation of the TLS/SSL protocols uses algorithms from a cipher suite to create keys and encrypt information. A cipher suite specifies one algorithm for each of the following tasks:

Key exchange
Bulk encryption
Message authentication

AD FS uses Schannel.dll to perform its secure communications interactions. Currently AD FS supports all of the protocols and cipher suites that Schannel.dll supports.

Manage the TLS/SSL protocols and cipher suites

Important

This section contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully.

Be aware that changing the default security settings for SCHANNEL could break or prevent communications between certain clients and servers. This occurs if secure communication is required and they don't have a protocol to negotiate communications with.

If you're applying these changes, they must be applied to all of your AD FS servers in your farm. After applying these changes, a reboot is required.

Enable and disable SSL 3.0

Use the following registry keys and their values to enable and disable SSL 3.0.

Enable SSL 3.0

Path	Value Name	Value Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server	Enabled	00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server	DisabledByDefault	00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client	Enabled	00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client	DisabledByDefault	00000000

Disable SSL 3.0

Path	Value Name	Value Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server	Enabled	00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server	DisabledByDefault	00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client	Enabled	00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client	DisabledByDefault	00000001

Use PowerShell to disable SSL 3.0

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' -name 'Enabled' -value '0' -PropertyType 'DWord' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-NullNew-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client' -name 'Enabled' -value '0' -PropertyType 'DWord' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-NullWrite-Host 'SSL 3.0 has been disabled.'

Enable and disable TLS 1.0

Use the following registry keys and their values to enable and disable TLS 1.0.

Important

Disabling TLS 1.0 breaks the WAP to AD FS trust. If you disable TLS 1.0, you should enable strong authentication for your applications. For more information, see Enable strong authentication for .NET applications

Enable TLS 1.0

Path	Value Name	Value Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server	Enabled	00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server	DisabledByDefault	00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client	Enabled	00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client	DisabledByDefault	00000000

Disable TLS 1.0

Path	Value Name	Value Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server	Enabled"=00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server	DisabledByDefault	00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client	Enabled	00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client	DisabledByDefault	00000001

Use PowerShell to disable TLS 1.0

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -name 'Enabled' -value '0' -PropertyType 'DWord' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-NullNew-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -name 'Enabled' -value '0' -PropertyType 'DWord' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-NullWrite-Host 'TLS 1.0 has been disabled.'

Enable and disable TLS 1.1

Use the following registry keys and their values to enable and disable TLS 1.1.

Enable TLS 1.1

Path	Value Name	Value Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server	Enabled	00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server	DisabledByDefault	00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client	Enabled	00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client	DisabledByDefault	00000000

Disable TLS 1.1

Path	Value Name	Value Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server	Enabled	00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server	DisabledByDefault	00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client	Enabled	00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client	DisabledByDefault	00000001

Use PowerShell to disable TLS 1.1

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -name 'Enabled' -value '0' -PropertyType 'DWord' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-NullNew-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -name 'Enabled' -value '0' -PropertyType 'DWord' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-NullWrite-Host 'TLS 1.1 has been disabled.'

Disable TLS 1.2

TLS 1.2 is enabled by default starting with Windows Server 2012. You can use the following registry keys and their values to disable TLS 1.2.

Note

It's not recommended to disable TLS 1.2.

Path	Value Name	Value Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server	Enabled	00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server	DisabledByDefault	00000001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client	Enabled	00000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client	DisabledByDefault	00000001

Use PowerShell to disable TLS 1.2

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -name 'Enabled' -value '0' -PropertyType 'DWord' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-NullNew-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -name 'Enabled' -value '0' -PropertyType 'DWord' -Force | Out-NullNew-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-NullWrite-Host 'TLS 1.2 has been disabled.'

Enable or disable hashes, ciphers, and cipher suites

Controlling ciphers, hashes and key exchange algorithms, other than Key size, via the registry isn't supported. Hashes, ciphers and key exchange algorithms are controlled via PowerShell, MDM or Cipher Suite Ordering.

For a full list of supported cipher suites, see Cipher Suites in TLS/SSL (Schannel SSP). This article provides a table of suites that are enabled by default, and it shows which suites are supported but not enabled by default. To prioritize the cipher suites, see Prioritizing Schannel Cipher Suites.

Enable strong authentication for .NET applications

The .NET Framework 3.5/4.0/4.5.x applications can switch the default protocol to TLS 1.2 by enabling the SchUseStrongCrypto registry key. These registry keys force .NET applications to use TLS 1.2.

Important

For AD FS on Windows Server 2016 and Windows Server 2012 R2, you need to use the .NET Framework 4.0/4.5.x key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319

For the .NET Framework 3.5, use the following registry key:

Path	Value Name	Value Data
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727	SchUseStrongCrypto	00000001

For the .NET Framework 4.0/4.5.x, use the following registry key:

Path	Value Name	Value Data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319	SchUseStrongCrypto	00000001

New-ItemProperty -path 'HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -name 'SchUseStrongCrypto' -value '1' -PropertyType 'DWord' -Force | Out-Null

Additional information

Cipher Suites in TLS/SSL (Schannel SSP)
Prioritizing Schannel Cipher Suites
Speaking in Ciphers and other Enigmatic tongues

Manage SSL/TLS protocols and cipher suites for AD FS (2024)

FAQs

Does ADFS use TLS? ›

Only TLS 1.1 and later versions are supported in the ADFS serviceOffice.

Read On ›

How do I check my TLS and SSL settings? ›

Click Start or press the Windows key. In the Start menu, either in the Run box or the Search box, type regedit and press Enter. The Registry Editor window should open and look similar to the example shown below. Check the subkeys for each SSL/TLS version for both server and client.

Discover More Details ›

How do I change my SSL and TLS settings? ›

Google Chrome

Open Google Chrome.
Click Alt F and select Settings.
Scroll down and select Show advanced settings...
Scroll down to the Network section and click on Change proxy settings...
Select the Advanced tab.
Scroll down to Security category, manually check the option box for Use TLS 1.1 and Use TLS 1.2.
Click OK.

More items...

Nov 1, 2023

How do I enable TLS in Active Directory? ›

Solution

Open the Control Panel on a domain controller.
Open the Add or Remove Programs applet.
Click on Add/Remove Windows Components.
Check the box beside Certificate Services and click Yes to verify.
Click Next.

More items...

See Details ›

Does AD FS require SSL? ›

Determining your CA strategy. AD FS does not require that certificates be issued by a CA. However, the SSL certificate (the certificate that is also used by default as the service communications certificate) must be trusted by the AD FS clients.

Find Out More ›

What protocol does AD FS use? ›

A: The main role of ADFS is to offer SSO protocol outside the corporate firewall environment. This is possible through claimed-based access control by provisioning cookies and Security Assertion Markup Language.

Tell Me More ›

How to check TLS cipher suite? ›

Find the cipher using Chrome

Select More tools > Developer tools > Security. Look for the line "Connection...". This will describe the version of TLS or SSL used.

Show Me More ›

What is the difference between SSL and TLS? ›

SSL is technology your applications or browsers may have used to create a secure, encrypted communication channel over any network. However, SSL is an older technology that contains some security flaws. Transport Layer Security (TLS) is the upgraded version of SSL that fixes existing SSL vulnerabilities.

Explore More ›

How do I know if my certificate is SSL or TLS? ›

First, check if the URL of the website begins with HTTPS, where S indicates it has an SSL certificate. Second, click on the padlock icon on the address bar to check all the detailed information related to the certificate.

How do I enable or disable SSL and TLS versions? ›

In the Internet Options window on the Advanced tab, under Settings, scroll down to the Security section. In the Security section, locate the Use SSL and Use TLS options and uncheck Use SSL 3.0 and Use SSL 2.0. If they are not already selected, check Use TLS 1.0, Use TLS 1.1, and Use TLS 1.2.

Show Me More ›

How do I know if TLS 1.2 is enabled? ›

In the Windows menu search box, type Internet options. Under Best match, click Internet Options. In the Internet Properties window, on the Advanced tab, scroll down to the Security section. Check the User TLS 1.2 checkbox.

Read The Full Story ›

Where are ciphers in the registry? ›

Configure allowed cipher suites

Open regedit.exe and go to: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002. Edit the Functions key, and set its value to the list of Cipher Suites that you want to allow.

See Details ›

How to enable SSL on Active Directory? ›

Select Start | All Programs | Windows Support Tools | Command Prompt. Start the ldp tool by typing ldp at the command prompt. From the ldp window, select Connection | Connect and supply the host name and port number (636). Also select the SSL check box.

Get More Info Here ›

What port does Active Directory use for SSL? ›

By default, Active Directory Domain Services bind to port 389 for insecure LDAP requests and 636 for LDAP over SSL (LDAPS).

How do I find my TLS server settings? ›

For Chrome

Open the Developer Tools (Ctrl+Shift+I)
Select the Security tab.
Navigate to the WebAdmin or Cloud Client portal.
Under Security, check the results for the section Connection to check which TLS protocol is used.

Jul 5, 2024

What authentication does AD FS use? ›

ADFS makes use of the claims-based Access Control Authorization model to ensure security across applications using the federated identity. Claims-based authentication is a process in which a user is identified by a set of claims related to their identity.

View Details ›

Does Microsoft Exchange use TLS? ›

They are because it will use Opportunistic TLS. By default, Exchange Online always uses opportunistic TLS. This means Exchange Online always tries to encrypt connections with the most secure version of TLS first, then works its way down the list of TLS ciphers until it finds one on which both parties can agree.

How do I know if an application is using TLS? ›

For Chrome

Open the Developer Tools (Ctrl+Shift+I)
Select the Security tab.
Navigate to the WebAdmin or Cloud Client portal.
Under Security, check the results for the section Connection to check which TLS protocol is used.

Jul 5, 2024

Learn More ›

Is AD FS using SAML? ›

Active Directory Federation Services (AD FS) is one of the SAML 2.0 identity providers you can use to authenticate visitors to your Power Pages site. You can use any provider that conforms to the SAML 2.0 specification.

Discover More Details ›