SSL Registry
SSL Registry Settings
Windows Registry Editor Version 5.00

; Add and Enable TLS 1.2 for client and server SCHANNEL communications

[HKEY_LOCAL_MACHINE3.0]
[HKEY_LOCAL_MACHINE3.0]
"Enabled"=dword:ffffffff
"DisabledByDefault"=dword:00000000

; Add and Enable TLS 1.0 for client and server SCHANNEL communications

[HKEY_LOCAL_MACHINE1.0]
[HKEY_LOCAL_MACHINE1.0]
"Enabled"=dword:ffffffff
"DisabledByDefault"=dword:00000000

; Add and Enable TLS 1.1 for client and server SCHANNEL communications

[HKEY_LOCAL_MACHINE1.1]
[HKEY_LOCAL_MACHINE1.1]
"Enabled"=dword:ffffffff
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE1.1]
"Enabled"=dword:00000001
"DisabledByDefault"=dword:00000000

; Add and Enable TLS 1.2 for client and server SCHANNEL communications

[HKEY_LOCAL_MACHINE1.2]
[HKEY_LOCAL_MACHINE1.2]
"Enabled"=dword:ffffffff
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE1.2]
"Enabled"=dword:00000001
"DisabledByDefault"=dword:00000000

; Disable Multi-Protocol Unified Hello

[HKEY_LOCAL_MACHINE-Protocol Unified Hello]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

; Disable PCT 1.0

[HKEY_LOCAL_MACHINE1.0]
[HKEY_LOCAL_MACHINE1.0]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

; Disable SSL 2.0 (PCI Compliance)

[HKEY_LOCAL_MACHINE2.0]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

; Disable insecure ciphers

[HKEY_LOCAL_MACHINE56/56]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE40/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE56/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE128/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE40/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE56/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE64/128]
"Enabled"=dword:00000000

; Enable new secure ciphers

[HKEY_LOCAL_MACHINE128/128]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINEDES 168/168]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE128/128]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE256/256]
"Enabled"=dword:ffffffff

; Set hashes configuration

[HKEY_LOCAL_MACHINE]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE]
"Enabled"=dword:ffffffff

; Set KeyExchangeAlgorithms configuration

[HKEY_LOCAL_MACHINE-Hellman]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE]
"Enabled"=dword:ffffffff

; Set cipher suites order as secure as possible (Enables Perfect Forward Secrecy)

[HKEY_LOCAL_MACHINE0010002]
"Functions"="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA"