\documentclass[a4paper, 11pt]{article}
\renewcommand{\familydefault}{\sfdefault}
\usepackage{a4wide}
\usepackage[utf8]{inputenc}
\usepackage[ngerman]{babel}
\usepackage{color}
\usepackage{graphicx}
\usepackage{setspace}
\usepackage{ulem}
\usepackage{listings}
\usepackage{float}
\usepackage[rflt]{floatflt}
\usepackage{tabularx}
\setlength{\parindent}{0pt}
\title{SSL Registry}
\usepackage[
pdftitle={SSL Registry}
pdfsubject={}
pdfauthor={Udo Schmal}
pdfkeywords={}
]{hyperref}
\definecolor{darkblue}{rgb}{0,0,.5}
\hypersetup{pdftex=true, colorlinks=true, breaklinks=true, linkcolor=darkblue, menucolor=darkblue, pagecolor=darkblue, urlcolor=darkblue}
\begin{document}SSL Registry
\singlespacing
{\LARGE \textbf{\label{sec:title}SSL Registry Settings}}
\begin{lstlisting}[breaklines]Windows Registry Editor Version 5.00\newline
\newline
\newline
; Add and Enable TLS 1.2 for client and server SCHANNEL communications\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashSSL 3.0]\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashSSL 3.0\textbackslashServer]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\&quot;DisabledByDefault\&quot;=dword:00000000\newline
\newline
\newline
; Add and Enable TLS 1.0 for client and server SCHANNEL communications\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashTLS 1.0]\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashTLS 1.0\textbackslashServer]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\&quot;DisabledByDefault\&quot;=dword:00000000\newline
\newline
\newline
; Add and Enable TLS 1.1 for client and server SCHANNEL communications\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashTLS 1.1]\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashTLS 1.1\textbackslashServer]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\&quot;DisabledByDefault\&quot;=dword:00000000\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashTLS 1.1\textbackslashClient]\newline
\&quot;Enabled\&quot;=dword:00000001\newline
\&quot;DisabledByDefault\&quot;=dword:00000000\newline
\newline
; Add and Enable TLS 1.2 for client and server SCHANNEL communications\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashTLS 1.2]\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashTLS 1.2\textbackslashServer]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\&quot;DisabledByDefault\&quot;=dword:00000000\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashTLS 1.2\textbackslashClient]\newline
\&quot;Enabled\&quot;=dword:00000001\newline
\&quot;DisabledByDefault\&quot;=dword:00000000\newline
\newline
; Disable Multi-Protocol Unified Hello\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashMulti-Protocol Unified Hello\textbackslashServer]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\&quot;DisabledByDefault\&quot;=dword:00000001\newline
\newline
; Disable PCT 1.0\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashPCT 1.0]\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashPCT 1.0\textbackslashServer]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\&quot;DisabledByDefault\&quot;=dword:00000001\newline
\newline
; Disable SSL 2.0 (PCI Compliance)\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashProtocols\textbackslashSSL 2.0\textbackslashServer]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\&quot;DisabledByDefault\&quot;=dword:00000001\newline
\newline
; Disable insecure ciphers\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashDES 56/56]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashNULL]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashRC2 40/128]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashRC2 56/128]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashRC2 128/128]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashRC4 40/128]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashRC4 56/128]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashRC4 64/128]\newline
\&quot;Enabled\&quot;=dword:00000000\newline
\newline
; Enable new secure ciphers\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashRC4 128/128]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashTriple DES 168/168]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashAES 128/128]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashCiphers\textbackslashAES 256/256]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\newline
; Set hashes configuration\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashHashes\textbackslashMD5]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashHashes\textbackslashSHA]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\newline
; Set KeyExchangeAlgorithms configuration\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashKeyExchangeAlgorithms\textbackslashDiffie-Hellman]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSYSTEM\textbackslashCurrentControlSet\textbackslashControl\textbackslashSecurityProviders\textbackslashSCHANNEL\textbackslashKeyExchangeAlgorithms\textbackslashPKCS]\newline
\&quot;Enabled\&quot;=dword:ffffffff\newline
\newline
; Set cipher suites order as secure as possible (Enables Perfect Forward Secrecy)\newline
\newline
[HKEY\_LOCAL\_MACHINE\textbackslashSOFTWARE\textbackslashPolicies\textbackslashMicrosoft\textbackslashCryptography\textbackslashConfiguration\textbackslashSSL\textbackslash00010002]\newline
\&quot;Functions\&quot;=\&quot;TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384\_P521,TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384\_P384,TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384\_P256,TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA\_P521,TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA\_P384,TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA\_P256,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256\_P521,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA\_P521,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256\_P384,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256\_P256,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA\_P384,TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA\_P256,TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384\_P521,TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384\_P384,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256\_P521,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256\_P384,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256\_P256,TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384\_P521,TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384\_P384,TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA\_P521,TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA\_P384,TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA\_P256,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256\_P521,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256\_P384,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256\_P256,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA\_P521,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA\_P384,TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA\_P256,TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA256,TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA,TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256,TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA,TLS\_DHE\_DSS\_WITH\_3DES\_EDE\_CBC\_SHA,TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA256,TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA,TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA256,TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA,TLS\_RSA\_WITH\_RC4\_128\_SHA,TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA\&quot; \end{lstlisting}
\end{document}