How to implement Transport Layer Security 1.2

This article describes how to allow System Center Operations Manager to utilize Transport Layer Security (TLS) 1.2.

Perform the following steps to implement TLS protocol version 1.2 in Operations Manager:

Operations Manager generates SHA1 and SHA2 self-signed certificates. This is required to enable TLS 1.2. If CA-signed certificates are used, ensure that the certificates are either SHA1 or SHA2.

Configure Windows Operating System to only use TLS 1.2 protocol

Use one of the following methods to configure Windows to use only the TLS 1.2 protocol.

Method 1: Manually modify the registry

Use the following steps to enable/disable all SCHANNEL protocols system-wide. We recommend that you enable the TLS 1.2 protocol for all incoming communications and outgoing communications.

1. Sign in to the server by using an account that has local administrative credentials.

2. Start Registry Editor by selecting and holding Start, enter regedit in the Run textbox, and select OK.

3. Locate the following registry subkey:

   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

4. Create a subkey under Protocols for:

   1. SSL 2.0
   2. SSL 3.0
   3. TLS 1.0
   4. TLS 1.1
   5. TLS 1.2.

5. Create a Client and Server subkey under each protocol version subkey you created earlier. For example, the subkey for TLS 1.0 would be

   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server

6. To disable each protocol, create the following DWORD values under Server and Client:

   • Enabled [Value = 0]
   • DisabledByDefault [Value = 1]

7. To enable the TLS 1.2 protocol, create the following registry keys:

   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server:

8. Then create the following DWORD values under Server and Client:

   • Enabled [Value = 1]
   • DisabledByDefault [Value = 0]

9. Close the Registry Editor.

Method 2: Automatically modify the registry

Run the following Windows PowerShell script as Administrator to automatically configure your Windows Operating System to use only the TLS 1.2 Protocol:

$ProtocolList       = @("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1", "TLS 1.2")
$ProtocolSubKeyList = @("Client", "Server")
$DisabledByDefault  = "DisabledByDefault"
$registryPath       = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\"

foreach ($Protocol in $ProtocolList)
{
    foreach ($key in $ProtocolSubKeyList)
    {
        $currentRegPath = $registryPath + $Protocol + "\" + $key
        Write-Output "Current Registry Path: `"$currentRegPath`""

  if (!(Test-Path $currentRegPath))
  {
    Write-Output " `'$key`' not found: Creating new Registry Key"
    New-Item -Path $currentRegPath -Force | out-Null
  }
  if ($Protocol -eq "TLS 1.2")
  {
    Write-Output " Enabling - TLS 1.2"
    New-ItemProperty -Path $currentRegPath -Name $DisabledByDefault -Value "0" -PropertyType DWORD -Force | Out-Null
    New-ItemProperty -Path $currentRegPath -Name 'Enabled' -Value "1" -PropertyType DWORD -Force | Out-Null
  }
  else
  {
    Write-Output " Disabling - $Protocol"
    New-ItemProperty -Path $currentRegPath -Name $DisabledByDefault -Value "1" -PropertyType DWORD -Force | Out-Null
    New-ItemProperty -Path $currentRegPath -Name 'Enabled' -Value "0" -PropertyType DWORD -Force | Out-Null
  }
  Write-Output " "
}

Configure .NET Framework to use only TLS 1.2

.NET typically requires the application to define what TLS protocol to use for communication, in the instance of SCOM however, we will need to tell .NET system-wide what protocol to use.

After completing the configuration of all prerequisites for Operations Manager, perform the following steps on all management servers, the server hosting the Web console role, and on any Windows computer the agent is installed on.

Manually modify the registry

1. Open the Registry Editor
2. Locate the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727
   1. Create the following DWORD value pairs:
      • SchUseStrongCrypto [Value = 1]
      • SystemDefaultTlsVersions [Value = 1]
3. Locate the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727
   1. Create the following DWORD value pairs:
      • SchUseStrongCrypto [Value = 1]
      • SystemDefaultTlsVersions [Value = 1]
4. Locate the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319
   1. Create the following DWORD value pairs:
      • SchUseStrongCrypto [Value = 1]
      • SystemDefaultTlsVersions [Value = 1]
5. Locate the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319
   1. Create the following DWORD value pairs:
      • SchUseStrongCrypto [Value = 1]
      • SystemDefaultTlsVersions [Value = 1]
6. Restart the system for the settings to take effect.

Automatically modify the registry

Run the following Windows PowerShell script in Administrator mode to automatically configure .NET Framework to prevent framework-inherited TLS 1.0 dependencies:

# Tighten up the .NET Framework
$NetRegistryPath1 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727" 
New-ItemProperty -Path $NetRegistryPath1 -Name "SchUseStrongCrypto" -Value "1" -PropertyType DWORD -Force | Out-Null 
New-ItemProperty -Path $NetRegistryPath1 -Name "SystemDefaultTlsVersions" -Value "1" -PropertyType DWORD -Force | Out-Null

$NetRegistryPath2 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" 
New-ItemProperty -Path $NetRegistryPath2 -Name "SchUseStrongCrypto" -Value "1" -PropertyType DWORD -Force | Out-Null
New-ItemProperty -Path $NetRegistryPath2 -Name "SystemDefaultTlsVersions" -Value "1" -PropertyType DWORD -Force | Out-Null

$NetRegistryPath3 = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" 
New-ItemProperty -Path $NetRegistryPath3 -Name "SchUseStrongCrypto" -Value "1" -PropertyType DWORD -Force | Out-Null 
New-ItemProperty -Path $NetRegistryPath3 -Name "SystemDefaultTlsVersions" -Value "1" -PropertyType DWORD -Force | Out-Null

$NetRegistryPath4 = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" 
New-ItemProperty -Path $NetRegistryPath4 -Name "SchUseStrongCrypto" -Value "1" -PropertyType DWORD -Force | Out-Null
New-ItemProperty -Path $NetRegistryPath4 -Name "SystemDefaultTlsVersions" -Value "1" -PropertyType DWORD -Force | Out-Null

Additional settings

If you're monitoring a supported version of Linux server with Operations Manager, follow the instructions on the appropriate website for your distro to configure TLS 1.2.

Next steps

• For a complete listing of ports used, the direction of the communication, and if the ports can be configured, see Configuring a Firewall for Operations Manager.

• For an overall review of how data between components in a management group is protected, see Authentication and Data Encryption in Operations Manager.