Query for TLS versions
Patrick Garber
Hello,
I have a piece of software that requires TLS 1.2+ enabled on systems for communications. Is there an easy way to query the different versions of TLS enabled on a machine? Trying to build out collections based on this information to re-mediate.
1
Comments
Patrick,
This document by Microsoft seems to list registry keys for TLS 1.2 that you can check for to determine whether it is enabled or disabled. There is a different registry entry for each client and server, so you will need to determine whether your software requires your computers to be a TLS 1.2 client or a TLS 1.2 server.
https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings
EDIT: After more testing it looks like that key usually doesn't exist unless you explicitly create it-- TLS 1.2 could be enabled even if the "Enabled" registry key does not exist. This method might not work for you.
This is what I have to detect TLS 1.2 disabled. Windows 2012 R2 or better automatically has it enabled and has no entry int he registry. Older Windows requires an entry to enable it.
This is just for server side but you can go from here.
Another option is this PowerShell Scanner: https://github.com/pdq/PowerShell-Scanners/tree/master/PowerShell%20Scanners/Cipher%20Suite%20Detection