Selecting TLS/SSL Encryption Methods

The TLS Cipher Suites section allows you to:
  • Include which cipher suites are permissible.
  • Indicate cipher suite order of preference.

A cipher suite is a named combination of authentication, encryption, and message authentication code (MAC) algorithms used to negotiate the security settings. By default, all ciphers suites enabled in the base Windows OS are enabled.

To Include a Cipher Suite

You can either click the check box in the Enabled to select/enable a cipher suite at the server or click a selected check box to clear it (disables the cipher suite at the server).

To Indicate Priority

Entries closer to the top of the list are given preference over entries lower down. Use the arrow buttons to move entries up or down in the list. Even if you must permit weaker cipher suites, you should always put the stronger ones at the top of the list.
Note: Both the client's and the server's preferences are taken into consideration when choosing the actual cipher for a given session. Though the server's first choice won't always be chosen, for a session to occur, the cipher used for the connection must be in the set of allowed algorithms on both sides.

Selecting TLS (SSL) Versions

TLS Versions are shown at the bottom of the TLS Tab. The default selections include TLS 1.0, 1.1, 1.2, and 1.3. The version(s) selected determine the cipher suites that are available.

Select a check box to disable a selected version, or to enable an unselected version.

Note: After any TLS Version change, you need to reboot the system before the change takes effect.
Note: Be aware that the following security policy setting: System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing will restrict the available cipher suites and protocols. For example, where TLS is currently the FIPS standard, TLS will be required.
Note: Be aware that the setting TLS cipher suite order via Group Policy will override any changes made to cipher suite order on this tab.