title: Cannot Enable TLS 1.2 on Windows Server 2008 SP2
body: <p>We have recently upgraded our Java version to <code>JDK 1.8.0_141</code> which is forcing our java client to use <code>TLS 1.2</code> and we have a <code>.Net 2.0</code> web service running on a <code>Windows Server 2008 SP2</code> which supports only <code>SSL V3</code> and <code>TLS 1.0</code> </p>
  
  <pre><code>OS Name:                   Microsoft Windows Server 2008 Standard
  OS Version:                6.0.6002 Service Pack 2 Build 6002
  </code></pre>
  
  <p>So I've applied the patch <code>(Update for Windows Server 2008 (KB4019276))</code> from below KB to enable <code>TLS 1.1</code> and <code>TLS 1.2</code></p>
  
  <p><a href="https://support.microsoft.com/en-us/help/4019276/update-to-add-support-for-tls-1-1-and-tls-1-2-in-windows" rel="nofollow noreferrer">https://support.microsoft.com/en-us/help/4019276/update-to-add-support-for-tls-1-1-and-tls-1-2-in-windows</a></p>
  
  <p>And added below registry entries</p>
  
  <pre><code>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\TLS 1.1]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\TLS 1.1\Client]
  "Enabled"=dword:00000001
  "DisabledByDefault"=dword:00000000
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\TLS 1.1\Server]
  "Enabled"=dword:00000001
  "DisabledByDefault"=dword:00000000
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\TLS 1.2]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\TLS 1.2\Client]
  "Enabled"=dword:00000001
  "DisabledByDefault"=dword:00000000
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\TLS 1.2\Server]
  "Enabled"=dword:00000001
  "DisabledByDefault"=dword:00000000
  </code></pre>
  
  <p>And restarted the box, but still the <code>.Net 2.0</code> web service is not supporting 
  <code>TLS 1.2</code> but supports <code>TLS 1.1</code>. Tested using <code>TestSSLServer</code> (www.bolet.org/TestSSLServer/)</p>
  
  <pre><code>TestSSLServer2.exe validation-service 443
  Connection: validation-service:443
  SNI: validation-service
    SSLv3:
       server selection: enforce server preferences
       3-- (key:  RSA)  RSA_WITH_RC4_128_SHA
       3-- (key:  RSA)  RSA_WITH_3DES_EDE_CBC_SHA
       3-- (key:  RSA)  RSA_WITH_RC4_128_MD5
    TLSv1.0:
       server selection: enforce server preferences
       3-- (key:  RSA)  RSA_WITH_AES_128_CBC_SHA
       3-- (key:  RSA)  RSA_WITH_AES_256_CBC_SHA
       3-- (key:  RSA)  RSA_WITH_RC4_128_SHA
       3-- (key:  RSA)  RSA_WITH_3DES_EDE_CBC_SHA
       3-- (key:  RSA)  RSA_WITH_RC4_128_MD5
    TLSv1.1: idem
  </code></pre>
  
  <p>Is there any config change needed to enable <code>TLS 1.2</code>? Or do I need to apply any other KB Patch? </p>