TMA-IIS-7.6
Ensure TLS 1.2 is Enabled
MediumLevel 1Automatediis
Description
TLS 1.2 is the most recent and mature protocol for protecting the confidentiality and integrity of HTTP traffic. SCHANNEL\Protocols\TLS 1.2\Server must have Enabled=1 and DisabledByDefault=0. PowerShell 5.1; reads the registry (run elevated).
How it is checked
Audit method: Windows registry
registry
$base = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols'; $p = Get-ItemProperty -Path "$base\TLS 1.2\Server" -ErrorAction SilentlyContinue; if ($null -ne $p -and $p.Enabled -eq 1 -and $p.DisabledByDefault -eq 0) { 'compliant' } else { 'noncompliant' }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force | Out-Null; set DWORD Enabled=1 and DisabledByDefault=0, then reboot.
Properties
- Operating systems
- Any
- Tags
- iistls
- Reference
- CIS Microsoft IIS 10 Benchmark v1.2.1 - 7.6 Ensure TLS 1.2 is Enabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target iis