Enable TLS 1.2 and disable SSL 3.0 on Exchange Servers

On October 31 Microsoft will disable TLS 1.1 for Exchange. If you have not changed your environment to TLS 1.2 yet, you should do that asap!

Here, the way how you can do this for Exchange server 2010  on Windows Server 2008 R2:

 

Disable SSL 3.0

The most steps we need to do are in the registry. Here we have some folders and entries which have to be created if they don’t exist yet. However, to disable SSL 3.0 on Exchange servers, we need to browse the registry to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\SSL 3.0

 

If this path does not exist completely, we can create it using PowerShell and the following command:

Now we need to create a new DWORD property, this can be done with the following command:

 

Restart Server

At this point we need to reboot our server. This can be done with this PowerShell command:

 

Enable TLS 1.2

Now, we are ready to create the next keys in the registry to enable TLS 1.2 for client and server schannel communications. Note, they are not created by Windows out of the box.

This can be done by PowerShell as well. We simply run the following commands:

 

To enable TLS 1.2 we need this commands:

 

Edit the server to use of the 256-bit ciphers as default

Click Start->gpedit.msc

Expand Computer Configuration -> Administrative Templates -> Network and select “SSL Configuration Settings”

Double click “SSL Cipher Suite Order” and check “Enabled”

 

Copy the text from the “SSL Cipher Suites” and paste it into Notepad.

 

Move the following to the beginning of the text document: TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA (Note: here you could remove lower strength ciphers from the order to prevent the server from accepting those connections).

 

Paste the Cipher Suites back into the SSL Cipher Suites box in Group Policy and click OK

 

Restart the server for the changes to take effect.

 

 

Now, the Exchange server is ready for working with TLS 1.2.

Note: if you have load balancers, please enable TLS 1.2 and disabling TLS 1.0 and TLS 1.1 on the load balancers, too.

 

Photo by Patryk Grądys on Unsplash

Drago is a Microsoft professional for Office 365, Microsoft Exchange, PowerShell and Cloud services. He works as senior System Engineer and Consultant in a leading swiss IT company and CSP. He is also a Trainer for Microsoft Cloud services and Web 2.0 in swiss schools.

Leave a Reply

Your email address will not be published. Required fields are marked *