Disable TLS 1.0 & 1.1

TLS (Transport Layer Security) is a cryptographic protocol used to secure communications over a channel or connection. It replaces the now deprecated SSL (Secure Socket Layer) standard. The IETF (Internet Engineering Task Force) is the group who publishes this standard and has, since its initial release, put out four version:

1. TLS 1.0 (1999)
2. TLS 1.1 (2006)
3. TLS 1.2 (2008)
4. TLS 1.3 (2018)

Both TLS 1.0 and 1.1 are now considered deprecated (2021) and should no longer be used in a modern network. In this article, we’ll walk through disabling TLS 1.0 and 1.1 using a free product called IIS Crypto, produced by Nartec Software.

Preparations

Prior to disabling TLS, audit your environment of services which interact with Active Directory via TLS but are limited to TLS version 1.0 and 1.1. Some things I’ve learned through my own experiences:

• Active Directory itself has no problem with TLS 1.0 and 1.1 disabled. This is assuming an up-to-date Windows Server 2016 or above operating system.
• The Microsoft Entra Connect service works with TLS 1.0 and 1.1 disabled.
• Check and confirm each service which relies on LDAPS for communications to the DC. Most modern software solutions should work without issue.

Instructions

When ready, walk through these steps to disable TLS 1.0 and 1.1.