This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(294.40000000000003, 32%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMO%3C/text%3E%3C/svg%3E)
Hey guys,
I've created restrictions on our client devices so that they are only allowed to use TLS 1.2
Now in the event viewer i see tons of error messages:
"A fatal error occurred while creating a TLS client credential. The internal error state is 10013."
From a couple of google search (primarily https://zcusa.951200.xyz/en-us/dotnet/framework/network-programming/tls#systemdefaulttlsversions) i've tried the following:
Creating the TLS 1.2 key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2
Create subkeys for Client and Server with: DisabledByDefault 0 & Enabled 1
Created dword entries for .net 32 and 64 bit: 'HKLM:\SOFTWARE\WOW6432Node\Microsoft.NETFramework\v4.0.30319' / 'HKLM:\SOFTWARE\Microsoft.NETFramework\v4.0.30319' -name 'SystemDefaultTlsVersions' -value '1' and SchUseStrongCrypto '1' - Steps repeated for each .net framework key v1.0, v2.0.50727 and forth.
As an example
Our devices are running Windows 10 Enterprise edition. I've tried to test the changes on my device which is running 20H2.
Anyone with an idea of how i can proceed with the troubleshooting?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 4%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMA%3C/text%3E%3C/svg%3E)
Hi,
the value in the TLS 1.2/Client MUST BE ffffffff in Hex or (4294967295) in decimal.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(304, 57.99999999999999%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
@Miguel Angel Crespo The Hex value of ffffffff for the DisabledByDefault or Enabled KEY?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 45%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJK%3C/text%3E%3C/svg%3E)
Is there documentation or other sources for "ffffffff in Hex or (4294967295)"?
https://zcusa.951200.xyz/en-gb/dotnet/framework/network-programming/tls?WT.mc_id=Portal-Microsoft_Azure_Security#configuring-schannel-protocols-in-the-windows-registry Stated 1 to be correct value for DisabledByDefault and Enabled
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(179.20000000000002, 81%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENM%3C/text%3E%3C/svg%3E)
@Janne Kujanpää
The documentation conflicts you can find both 1 and ffffffff in MS Documents.
What I can tell you is that the ffffffff value is what is set by Nartac's IIS Crypto.
I decided to run a test on my own machine and setting 1 for enabled caused TLS to fail in my browser. Putting it back to ffffffff removed the problem.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 99%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAM%3C/text%3E%3C/svg%3E)
My L3 support is thinking it has to do with Windows 10 20H2 and upgrading to 21 will fix this. Updating drivers 1 by 1 to fix the issue until the new OS is pushed to all our laptops.
my effected system is on 21H2 19044.1889 so not sure about upgrading will fix :(
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(102.4, 25%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ED%3C/text%3E%3C/svg%3E)
I did read on a techhub, that large networks, that contain lots of servers and a large amount of client devices, there is likely to be servers, using only IPv4 or IPv4 and IPv6, this will generate TLS errors due to the mismatch of IPv4 and IPv6.. testing from a client, disable IPv4 test, then switch to IPv6 and test-
i spoke too soon it just crashed right in front of me :(
i came in this morning to see the computer has not crashed yet, it seems to happen on a 12 hour cycle looking at the logs
just dont know how to fix it yet :(
im awaiting the crash so i can look at logs, it should happen soon :( oddly came in this morning 9/6/2022
to a computer still running!
9/7/2022 @ 0630hrs computer not crashed, not sure if an update happened that has corrected it?
so far so good