As TLS 1.0 isn´t any longer "secure" every administrator should plan to make the switch to TLS 1.1 and TLS 1.2. Microsoft now released KB 3140245 which allows Administrators to specify which SSL protocols should be used when the WINHTTP_OPTION_SECURE_PROTOCOLS flag is used (e.g. in every Microsoft Office product as explained here).
According to KB 3140245 this can be controlled via DefaultSecureProtocols in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp.
The possible options here are:
TLS 1.1:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
"DefaultSecureProtocols"=dword:00000200
TLS 1.2:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
"DefaultSecureProtocols"=dword:00000800
TLS 1.1 + 1.2 (Preferred option):
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
"DefaultSecureProtocols"=dword:00000a00
Option 1 +2 are directly from the Microsoft website. However what most administrators do not know is that you can combine the hex values 00000200 and 00000800 (e.g. with an calculator in programmer mode) to get 00000a00. So option 3 would allow you to disable TLS 1.0 (as well as SSL 2.0 and 3.0) but allow TLS 1.1 and TLS 1.2 at the same time to allow a wider range of compatibility.
Comments
CSR SysAdmin