How to overcome Local Group Policy Editor's 1023 character limit?

Question

I want to reorder the SSL Cipher Suite Order applied as part of KB2919355, prioritizing the forward secrecy suites above all else.

Trying to do this with gpedit at Computer Configuration > Administrative Templates > Network > SSL Configuration Settings > SSL Cipher Suite Order is a problem because the new list goes over the tool's character limit.

Is there anyway to overcome this limit so I don't have to keep the current priority or omit something from the list?

Solution

Solution

1. Paste the list of available suites into a blank text document.

2. Edit the suite list as needed. When you're done, place a comma at the end of each suite name except the last one. Then remove all the line breaks in order to get a single line, and make sure there are no space characters.

3. Press Win+R, type or paste regedit.exe in the text box, and press Enter.

4. Navigate to the following registry key:

   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
   

   If the key isn't there, create it yourself.

5. Create a new string value (Edit > New > String Value) called Functions, in case it doesn't exist already. Double-click it to modify it, paste the suite list you created earlier into it, and click OK.

6. Restart Windows to apply the changes. To verify your configuration you can use this client test page: https://www.ssllabs.com/ssltest/viewMyClient.html

References

• GPS: SSL Cipher Suite Order
• Changing IE's SSL cipher order

Comments

[and31415]

If I understood correctly, here's explained how: gpsearch.azurewebsites.net/#58

[Louis Waweru]

@and31415 Yep, that's how, but the new list is about 1400 characters. Actually, the list that ships out of the box is over 1023 characters as well. So there's no editing it without removing some items. (I believe textboxes in gpedit have a 1023 character limit.)

[Louis Waweru]

For example, here is what I can copy from the textbox when it is seeded with the default, OOTB list. And here is what it gets truncated to after immediately pasting it back in.

[and31415]

What if you edit the Functions registry value directly?

[Louis Waweru]

@and31415 Okay, I think I just understood what you were pointing me at. I'll give it a shot.

[Louis Waweru]

@and31415 Thanks so much. Seems to be working according to this SSLLabs test (with a few quirks). Would you mind making an answer?