TLS 1.2 Protocol Support Deployment Guide for System Center 2016

Summary

This article describes how to enable Transport Layer Security (TLS) protocol version 1.2 in a Microsoft System Center 2016 environment.

More Information

To enable TLS protocol version 1.2 in your System Center environment, follow these steps:

1. Install updates from the release.
   
   Notes

   • Service Management Automation (SMA) and Service Provider Foundation (SPF) must be upgraded to their most recent update rollup because UR4 does not have any updates to these components.

   • For Service Management Automation (SMA), upgrade to Update Rollup 1, and also update the SMA management pack (MP) from this Microsoft Download Center webpage.

   • For Service Provider Foundation (SPF), upgrade to Update Rollup 2.

   • System Center Virtual Machine Manager (SCVMM) should be upgraded to at least Update Rollup 3.

2. Make sure that the setup is as functional as it was before you applied the updates. For example, check whether you can start the console.

3. Change the configuration settings to enable TLS 1.2.

4. Make sure that all required SQL Server services are running.

Set Windows to use only TLS 1.2

Use one of the following methods to configure Windows to use only the TLS 1.2 protocol.

Method 1: Manually modify the registry

Important
Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.

Use the following steps to enable/disable all SCHANNEL protocols system-wide. We recommend that you enable the TLS 1.2 protocol for incoming communications; and enable the TLS 1.2, TLS 1.1, and TLS 1.0 protocols for all outgoing communications.

Note Making these registry changes does not affect the use of Kerberos or NTLM protocols.

1. Start Registry Editor. To do this, right-click Start, type regedit in the Run box, and then click OK.

2. Locate the following registry subkey:

   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

3. Right-click the Protocol key, point to New, and then click Key.
   
   

4. Type SSL 3, and then press Enter.

5. Repeat steps 3 and 4 to create keys for TLS 0, TLS 1.1, and TLS 1.2. These keys resemble directories.

6. Create a Client key and a Server key under each of the SSL 3, TLS 1.0, TLS 1.1, and TLS 1.2 keys.

7. To enable a protocol, create the DWORD value under each Client and Server key as follows:

   DisabledByDefault [Value = 0]
   Enabled [Value = 1]
   To disable a protocol, change the DWORD value under each Client and Server key as follows:

   DisabledByDefault [Value = 1]
   Enabled [Value = 0]

8. On the File menu, click Exit.

Method 2: Automatically modify the registry

Run the following Windows PowerShell script in Administrator mode to automatically configure Windows to use only the TLS 1.2 Protocol:

$ProtocolList       = @("SSL 2.0","SSL 3.0","TLS 1.0", "TLS 1.1", "TLS 1.2")
$ProtocolSubKeyList = @("Client", "Server")
$DisabledByDefault = "DisabledByDefault"
$Enabled = "Enabled"
$registryPath = "HKLM:\\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\"

foreach($Protocol in $ProtocolList)
{
    Write-Host " In 1st For loop"
	foreach($key in $ProtocolSubKeyList)
	{		
		$currentRegPath = $registryPath + $Protocol + "\" + $key
		Write-Host " Current Registry Path $currentRegPath"
		
		if(!(Test-Path $currentRegPath))
		{
		    Write-Host "creating the registry"
			New-Item -Path $currentRegPath -Force | out-Null			
		}
		if($Protocol -eq "TLS 1.2")
		{
		    Write-Host "Working for TLS 1.2"
			New-ItemProperty -Path $currentRegPath -Name $DisabledByDefault -Value "0" -PropertyType DWORD -Force | Out-Null
			New-ItemProperty -Path $currentRegPath -Name $Enabled -Value "1" -PropertyType DWORD -Force | Out-Null
		
		}
		else
		{
		    Write-Host "Working for other protocol"
			New-ItemProperty -Path $currentRegPath -Name $DisabledByDefault -Value "1" -PropertyType DWORD -Force | Out-Null
			New-ItemProperty -Path $currentRegPath -Name $Enabled -Value "0" -PropertyType DWORD -Force | Out-Null
		}	
	}
}

Exit 0

Set System Center to use only TLS 1.2

Set System Center to use only the TLS 1.2 protocol. To do this, first make sure that all prerequisites are met. Then, make the following settings on System Center components and all other servers on which agents are installed.

Use one of the following methods.

Method 1: Manually modify the registry

Important
Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.

To enable the installation to support the TLS 1.2 protocol, follow these steps:

1. Start Registry Editor. To do this, right-click Start, type regedit in the Run box, and then click OK.

2. Locate the following registry subkey:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319

3. Create the following DWORD value under this key:

   SchUseStrongCrypto [Value = 1]

4. Locate the following registry subkey:

   HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319

5. Create the following DWORD value under this key:

   SchUseStrongCrypto [Value = 1]

6. Restart the system.

Method 2: Automatically modify the registry

Run the following Windows PowerShell script in Administrator mode to automatically configure System Center to use only the TLS 1.2 Protocol:

# Tighten up the .NET Framework
$NetRegistryPath = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319"
New-ItemProperty -Path $NetRegistryPath -Name "SchUseStrongCrypto" -Value "1" -PropertyType DWORD -Force | Out-Null

$NetRegistryPath = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319"
New-ItemProperty -Path $NetRegistryPath -Name "SchUseStrongCrypto" -Value "1" -PropertyType DWORD -Force | Out-Null

Additional settings

Third-party contact disclaimer

Microsoft provides third-party contact information to help you find additional information about this topic. This contact information may change without notice. Microsoft does not guarantee the accuracy of third-party contact information.