How to Add Required Cipher Suites | Axero Documentation

To set the specified TLS settings on a Windows web server, follow these steps:

1. Enable TLS 1.2
   1. Open Registry Editor
      1. Press Windows Key + R, type regedit, and press Enter.
      2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
   2. Create TLS 1.2 Key
      1. Right-click Protocols, select New > Key, and name it TLS 1.2.
      2. Under TLS 1.2, create two keys: Client and Server.
      3. Under both Client and Server, create two DWORD (32-bit) values with the following values:
      • DisabledByDefault with value 0.
      • Enabled with value 1.
   3. Disable Older TLS Versions
      • Navigate to the keys for TLS 1.0 and TLS 1.1, and set DisabledByDefault to 1 and Enabled to 0.
2. Prioritize Cipher Suites
   1. Open Group Policy Editor
      1. Press Windows Key + R, type gpedit.msc, and press Enter.
      2. Navigate to Computer Configuration > Administrative Templates > Network > SSL Configuration Settings.
   2. Configure SSL Cipher Suite Order
      1. Double-click SSL Cipher Suite Order and select Enabled.
      2. Copy the following list of cipher suites:

         TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

      3. Replace the list in the SSL Cipher Suites box with the copied list.
   3. Apply Changes
      • Click OK or Apply to save the changes.
   4. Restart the Server
      • The changes will take effect after a restart.

Following these steps, you will have enabled TLS 1.2 with strong ciphers and prioritized the required cipher suites on your Windows web server.