Skip to content

Instantly share code, notes, and snippets.

@Aldaviva

Aldaviva/cipher-suites.md

Last active August 21, 2024 07:12
Show Gist options
  • Save Aldaviva/04c31cd5af472a041ca73b53e1d8165b to your computer and use it in GitHub Desktop.
Save Aldaviva/04c31cd5af472a041ca73b53e1d8165b to your computer and use it in GitHub Desktop.
Download ZIP
Windows Server TLS cipher suites for A ranking on Qualys SSL Labs SSL Test
Raw
cipher-suites.md

SSL Cipher Suite Order

📃 Edit using gpedit.msc › Computer Configuration > Administrative Templates › Network > SSL Configuration Settings > SSL Cipher Suite Order.

🅰 These cipher suites will grant you an A+ ranking on Qualys SSL Labs SSL Server Test and testssl.sh.

⚡ Changes require a reboot to take effect.

⚠️ Using the Server 2019 cipher suite order on Server 2022 will result in Windows Update failures with the error message "we couldn't connect to the update service." Before upgrading from Server 2019 to Server 2022, make sure to disable this policy or set its value to the Server 2022 value below.

🍦 Default cipher suite orders are listed on Microsoft Learn for Server 2019, Server 2022, and other Windows versions.

Windows Server 2019

TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_NULL_SHA,TLS_PSK_WITH_AES_256_GCM_SHA384,TLS_PSK_WITH_AES_128_GCM_SHA256,TLS_PSK_WITH_NULL_SHA384,TLS_PSK_WITH_NULL_SHA256

Windows Server 2022

TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_NULL_SHA,TLS_PSK_WITH_AES_256_GCM_SHA384,TLS_PSK_WITH_AES_128_GCM_SHA256,TLS_PSK_WITH_AES_256_CBC_SHA384,TLS_PSK_WITH_AES_128_CBC_SHA256,TLS_PSK_WITH_NULL_SHA384,TLS_PSK_WITH_NULL_SHA256

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment