SSL Cipher Suite Order in Windows: Configure

Configuring the SSL cipher suite order in Windows lets you control which cryptographic algorithms the operating system offers during TLS/SSL handshakes. This is useful for enforcing stronger security, meeting compliance requirements, or resolving compatibility issues with legacy servers. You’ll need administrative access to the machine and a clear idea of which cipher suites you want to prioritize or disable.

What You’ll Need

Administrator account on the Windows machine
PowerShell or Command Prompt (run as Administrator)
Knowledge of the cipher suite names (e.g., TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)
Optional: a tool like openssl ciphers to test the result

Step-by-Step

Open an elevated PowerShell or Command Prompt. Right-click the Start button and select “Windows PowerShell (Admin)” or “Command Prompt (Admin)”. Confirm the UAC prompt.
List current cipher suites. Run Get-TlsCipherSuite (PowerShell) or netsh trace show tls (Command Prompt). The PowerShell cmdlet is easier to read and filter.
Identify the cipher suites you want. Note the exact names. For example: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384. You can also use Get-TlsCipherSuite | Where-Object {$_.Name -like "*AES*"} to filter.
Set the order. Use the Enable-TlsCipherSuite cmdlet with the -Position parameter. For example, to put a suite at the top: Enable-TlsCipherSuite -Name TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 -Position 0. To place it after another, use -Position 1, etc.
Disable unwanted suites. Use Disable-TlsCipherSuite -Name TLS_RSA_WITH_AES_128_CBC_SHA. This removes it from the list entirely.
Verify the new order. Run Get-TlsCipherSuite again and check the order. The list shows the priority from highest to lowest.
Test with a client. Use openssl s_client -connect yourserver.com:443 -cipher "ECDHE-RSA-AES256-GCM-SHA384" from another machine to confirm the server offers the suite you set.
Reboot or restart services. Some services (like IIS) may need a restart to pick up the new order. A full reboot is the safest way to ensure everything uses the updated configuration.

Common Mistakes

Using the wrong cipher suite name. Windows uses names like TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, not OpenSSL-style names. Check the exact name with Get-TlsCipherSuite.
Disabling all suites. If you disable every suite, TLS handshakes fail completely. Always keep at least one suite that supports the protocols you need (TLS 1.2 or 1.3).
Forgetting to run as administrator. The cmdlets fail with a permission error if you are not elevated.
Assuming the order applies to all applications. Some applications (like .NET with Schannel) may have their own cipher suite configuration that overrides the system order.

Tips

Use Get-TlsCipherSuite -Name "*GCM*" to see only modern authenticated encryption suites.
Back up the current list before making changes: Get-TlsCipherSuite | Select-Object Name | Out-File ciphers_backup.txt.
For TLS 1.3, the cipher suite order is fixed and not configurable in Windows. Only TLS 1.2 and below are affected.
Test in a non-production environment first. A wrong order can break connectivity for clients that only support a specific suite.
Use Group Policy for multiple machines: Computer Configuration > Administrative Templates > Network > SSL Configuration Settings. This is more maintainable than per-machine changes.

Troubleshooting

Changes don’t take effect. Restart the machine or at least the relevant services (IIS, RDP, etc.). Also verify that no application-level policy overrides the system order.

Error: “Access denied” when running Enable-TlsCipherSuite. Ensure you are running as Administrator. If you are, check that the Windows feature “Windows PowerShell” is fully enabled.

After disabling a suite, some clients fail to connect. That client may only support the disabled suite. Re-enable it temporarily and check the client’s supported suites with a tool like nmap --script ssl-enum-ciphers.

The cipher suite list is empty. This can happen if the system has no TLS 1.2 support enabled. Check that the TLS 1.2 registry keys are set (SCHANNEL). Use Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' to see if Enabled is 1.

Order resets after reboot. This is rare but can happen if a security policy or third-party tool resets it. Check Group Policy and any security software that manages TLS settings.

Frequently Asked Questions

Q: Does this affect TLS 1.3 cipher suites?
A: No. TLS 1.3 has a fixed set of cipher suites (like TLS_AES_256_GCM_SHA384) and Windows does not allow reordering them. The order setting only applies to TLS 1.2 and earlier.

Q: Can I set the order using the registry instead of PowerShell?
A: Yes, you can edit the HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers registry key, but it’s more error-prone. PowerShell is the recommended method.

Q: How do I know which cipher suites are secure?
A: Generally, prefer ECDHE key exchange, AES-GCM encryption, and SHA-2 hashing. Avoid RC4, DES, and CBC-mode ciphers without proper mitigations. Use a reputable security guide or tool to assess your list.

Q: Will this break older Windows clients?
A: Possibly. Older Windows versions (like Windows 7 without updates) may not support modern suites like ECDHE with AES-GCM. If you need to support them, keep a compatible suite lower in the order.

Q: How can I test the order from the command line?
A: Use openssl s_client -connect host:port -tls1_2 and look at the “Cipher is” line. Or use nmap --script ssl-enum-ciphers -p 443 host to see the server’s preferred order.

Q: Is there a way to export the current configuration?
A: Yes, Get-TlsCipherSuite | Select Name | Export-Csv ciphers.csv will save the list. You can later import it to restore.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →