Turn off encryption support
This policy setting determines which SSL and TLS protocol versions Internet Explorer and applications that obtain their connection settings from WinINet may use.
since 0.9.8.11
Purpose
Show registry keys (2)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocolsHKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols
This policy setting determines which SSL and TLS protocol versions Internet Explorer and applications that obtain their connection settings from WinINet may use. SecureProtocols is a REG_DWORD bitmask representing the permitted protocols from SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, and TLS 1.2.
When establishing a protected connection, the client and server compare their supported protocol versions. The connection can succeed only if both sides support at least one version permitted by this setting.
The value under HKLM applies in the computer context, while the value under HKCU applies in the user context.
Notes
Additional effects
A policy-controlled SecureProtocols value prevents users from changing the affected SSL and TLS selections in Internet Options. The policy value takes precedence over a user's selection stored in the non-policy Internet settings.
Security
Allowing obsolete protocols can weaken the protection provided by encrypted connections. SSL 2.0 and SSL 3.0 are obsolete, and TLS 1.0 and TLS 1.1 generally no longer meet current security requirements. Restricting the selection to sufficiently recent protocols prevents affected WinINet connections from falling back to an excluded older version.
This setting does not configure cipher suites or certificate validation. It is also not a system-wide switch for every Schannel or WinHTTP connection; those components have additional or separate protocol settings.
Possible side effects
Affected browsers and applications cannot establish protected connections to servers that support only an excluded SSL or TLS version. Negotiation also fails when the client and server have no permitted protocol version in common.
Applications that use WinINet can therefore experience connection failures even when they have no visible dependency on Internet Explorer. Applications with their own networking or TLS stack are not necessarily affected.
Notes
Microsoft's policy reference describes choices through TLS 1.2 for this setting. Whether a selected version can actually be used also depends on the Windows version, the application, and the underlying Schannel configuration. SSL 2.0 is no longer supported as of Windows 10, version 1607.
Microsoft documentation
Microsoft Learn: InternetExplorer Policy CSP – DisableEncryptionSupport
Microsoft Support: Manage TLS 1.0 and TLS 1.1 after the default behavior change