Enable TLS 1.2 Exchange 2010

Question

Due to Microsoft's announcement that TLS 1.0 and 1.1 will be end of support, the company is now asking to get TLS 1.2 enabled and by default.

My question is, what are the complete steps on enabling TLS 1.2 on Exchange 2010? We are currently running on RU17. What do I need to do to enable it?

I don't see TLS 1.2 in the Windows registry.

Solution

First, Install SP3 RU19:

https://technet.microsoft.com/en-us/library/hh135098(v=exchg.150).aspx

Using IIS crypto is the easiest way to check and set all your SChannel settings at a glance:

https://www.nartac.com/Products/IISCrypto

NOTE: If you disable TLS 1.0 and below then all of your clients will need to be at the correct patch level to communicate with all Exchange subsystems. Specifically Windows 7 clients need a special process that I recently went through here: Outlook 2013: MailTips, OOF, Free/Busy Availability all failing to pull from Exchange 2010 server

Comments

[JonHeinzig]

Thank you! The CAS/HUB servers are showing with TLS 1.2 enabled on Schannel but the MBX servers do not. Do all of the servers need to have TLS 1.2 on schannel?

[JonHeinzig]

Thank you! I'll further read through this. Is upgrading to RU19 really necessary or is RU17 good? It looks like the CAS/HUB servers on the environment already have 1.2 on the schannel registry but not the MBX(s). If I need to enable TLS 1.2, do all of the servers need to have it?

[HackSlash]

All servers and all clients need to be speaking the same language or you will get odd failures that will be very difficult to troubleshoot. Update everyone to RU19 and enable TLS1.1 + TLS1.2 then update and patch the clients before you turn off TLS1.0.

[Sembee]

The way I have read the guidance is that RU19 is required. If you want to disable TLS 1.0 then everything needs to be able to support it - clients and other servers. Otherwise it should downgrade to a version that is supported (the lowest downgrade being 1.0).

[JonHeinzig]

Thank you very much. One of my concerns is that, according to MS, Windows 2012 has TLS 1.2 enabled by default, but when I look at the SCAHNNEL registry setting, it doesn't have ANY entries for TLS. Can you help explain why? Thank you in advance.