Disable insecure TLS renegotiation with servers
Setting this DWORD value to `0` places Schannel in strict client mode for outbound TLS connections.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\AllowInsecureRenegoServers
Setting this DWORD value to 0 places Schannel in strict client mode for outbound TLS connections. The local computer can establish or renegotiate TLS sessions only with servers that support secure renegotiation.
If a server does not signal support for secure renegotiation, the Schannel client terminates the TLS connection attempt. The effect is therefore broader than blocking a subsequent insecure renegotiation: the initial TLS session with a noncompliant server cannot be established.
Notes
Security
Strict client mode prevents connections to servers that still use the older renegotiation behavior, which lacks a secure cryptographic binding between the original TLS session and the renegotiated session. This protects Schannel-based client connections from attacks that exploit that weakness.
The value does not disable secure TLS renegotiation, disable TLS as a whole, or control inbound TLS connections.
Possible side effects
Applications and services that use Schannel as a TLS client can no longer connect to older, unpatched, or otherwise incompatible TLS servers. This applies even when the application would not normally request renegotiation during the session.
Notes
Despite its name, AllowInsecureRenegoServers does not control the local computer's TLS server behavior. It determines whether the local Schannel client may connect to insecure or incompatible remote servers. The separate AllowInsecureRenegoClients value controls how the local Schannel server treats such clients.
This setting affects only applications and services that use the Windows Schannel security provider. It does not govern third-party TLS implementations.
Microsoft documentation
Microsoft Support: MS10-049 – Vulnerabilities in SChannel could allow remote code execution
Microsoft Learn: Transport Layer Security (TLS) registry settings