Self-Signed Cert with TLS 1.2

Question

I'm a novice in regards to Transport Layer Security stuff, to bear with me...

I have some https web apps that I test locally using self-signed certs created with selfssl.exe. The company recently pushed new rules to everyone's machines that prevent the browsers from loading https sites that use anything other than TLS 1.2. However, my browsers give me certificate errors when I load my locally-hosted test stuff if TLS 1.0 is not enabled. Is it possible to generate self-signed certs that will work with my browsers if only TLS 1.2 is enabled?

I'm using Windows 7 64 bit with IIS 7.5, and I test with a variety of browsers (IE 11, Firefox 46, and Chrome 50).

Solution 1

No, it is not possible

SSL/TLS in all versions works with x509 digital certificates. The difference between TLS versions is the protocol rules, not the certificate.

The browser warns usually when the used protocol is old(consideres less secure) or the certificate is not trusted

Solution 2

Eventually figured this out. The answer is kinda dumb...

On Windows 7 / Windows Server 2008 R2, the TLS 1.2 protocol is installed, but disabled by default. When Big Brother pushed everybody to TLS 1.2, they did it with SCHANNEL registry entries, but they did not create the "DisabledByDefault" entry set to "0" so it blew up the security of all the Windows 7 users on the domain.

So, if you're going to use registry hacks to push users over to TLS 1.2, be sure to follow the instructions from Microsoft and remember to create a "DisabledByDefault" entry in the TLS 1.2 SCHANNEL key. :-)

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn786418(v=ws.11)

Comments

[T.S.]

The true answer for your question is that TLS/SSL have nothing to do with Self Certs. These are two things that cross-cut but not tight to each other. You can have self cert or any cert. If this is not signed by some authority, browser might complain. You can choose to trust this cert and browser will not complain anymore. In other words in configuration - CERT relates to IIS/Browser. TLS-Registry