IIS TLS configuration generator (PowerShell)

The IIS preset of the TLS config generator produces a PowerShell script for Windows Server. The script sets which SSL/TLS versions Schannel accepts, limits and orders the cipher suites, imports your PFX certificate, binds it to the site and adds the HSTS header. Run it in an elevated PowerShell and restart the server.

Example: intermediate profile (excerpt)

$base = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols'
function Set-Protocol([string]$Name, [bool]$Enabled) {
    foreach ($side in 'Server', 'Client') {
        $key = "$base\$Name\$side"
        New-Item -Path $key -Force | Out-Null
        New-ItemProperty -Path $key -Name 'Enabled' -Value ([int]$Enabled) -PropertyType DWord -Force | Out-Null
        New-ItemProperty -Path $key -Name 'DisabledByDefault' -Value ([int](-not $Enabled)) -PropertyType DWord -Force | Out-Null
    }
}
Set-Protocol 'SSL 3.0' $false
Set-Protocol 'TLS 1.0' $false
Set-Protocol 'TLS 1.1' $false
Set-Protocol 'TLS 1.2' $true
Set-Protocol 'TLS 1.3' $true

$suites = @('TLS_AES_256_GCM_SHA384', 'TLS_AES_128_GCM_SHA256',
    'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384', 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256',
    'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256')
Get-TlsCipherSuite | Where-Object { $suites -notcontains $_.Name } | ForEach-Object { Disable-TlsCipherSuite -Name $_.Name }

The generated script also imports C:\certs\example.com.pfx, creates the https binding with SNI and adds Strict-Transport-Security.

Requirements

• Windows Server 2016 or newer with IIS 10. TLS 1.3 needs Windows Server 2022+.
• The TLS PowerShell module (built into Windows Server 2016 and later) for the cipher suite cmdlets.
• A PFX file with the private key and chain; create one with PEM to PFX. Use the 3DES compatibility mode for Windows Server 2016.

After running the script

1. Restart Windows: Schannel reads the protocol keys at boot.
2. Run the SSL checker against the site and confirm TLS 1.0/1.1 are rejected.
3. If an application stops connecting to an old server, re-enable the client side of that protocol only.

Common mistakes

• "The credentials supplied to the package were not recognized": the certificate was imported without its private key, or the app pool identity cannot read the key.
• Wrong certificate served: another binding without SNI on the same IP takes precedence. Use -SslFlags 1 (SNI) on every https binding.