Windows Server 2012 R2 – TLS 1.2 Issue

sslwindows-server-2012-r2

I am facing issues with TLS 1.2 on my Windows Server 2012 R2 (application web server,IIS), where I am unable to access https://api.nuget.org/v3/index.json via Internet Explorer even after I see that TLS 1.2 has been enabled.

I have another server with the same OS and same OS updates (but no IIS) and this server has no problem accessing the API or any other endpoint with TLS 1.2)

On the problematic server, I've tried the following:

  1. Used IISCrypto to enable everything -> Restart -> FAILED
  2. Manually Change Registry settings following Microsoft documentation – https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2 – FAILED
  3. Used the following Script to completely reset and re-enable only TLS 1.2 – https://www.hass.de/content/setup-microsoft-windows-or-iis-ssl-perfect-forward-secrecy-and-tls-12 – FAILED

At this time, I've spent the better of 3 days trying to troubleshoot and see what the issue is between these two servers, why one windows server works and another doesn't.

Any tips, troubleshooting steps or tools would be most welcome!

Screenshots
enter image description here

  • via Nuget CLR
  • on the problematic server
    enter image description here
  • On the server that works
    enter image description here

Best Answer

So, After hours of troubleshooting I was finally able to resolve the issue and get the API accessible from our server over TLS 1.2.

We have .net framework on our server which was having trouble accessing the API. Microsoft recommends we set the following registry to force SystemDefaultTlsVersions

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001
Related Topic