How to Configure Microsoft Windows 7 to use TLS Version 1.2 in outlook

• As of cPanel & WHM version 68, cpanel only support Transport Layer Security (TLS) protocol version 1.2, and we enable TLSv1.2 by default.
  • We will only support applications that use TLSv1.2 and strongly recommend that you enable TLSv1.2 on your server. 
• The instructions in this document only pertain to servers that run the Windows 7 operating system.
• We strongly recommend that you do not adjust the cipher and protocol settings for the Exim and Dovecot services on Windows 7. Servers on this operating system fail PCI compliance scans because of unpatched security vulnerabilities that exist in the following email clients:
  • Outlook 2007.
  • Outlook 2010.

Create registry keys

Install Windows update

You must download and install the KB3140245 Windows update from the Microsoft Update Catalog. This update will create the registry key paths in which you will create new registry keys. These registry keys will allow you to enable TLSv1.2 on your server.

After you download and install the update, you must restart your computer for the changes to take effect.

Add a registry key for Windows HTTP services

To add a registry key for Windows HTTP services, perform the following steps:

1. From the Windows Start menu, enter regedit.exe in the Search text box.
2. Click regedit.exe to open the Registry Editor.
3. Navigate to the following registry path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
4. Select the WinHttp key.
5. From the Menu bar, click Edit, select New, and click DWORD (32-bit) Value.Note: On 64-bit systems, click QWORD (64-bit) Value.
6. Enter DefaultSecureProtocols as the DWORD value’s name.
7. Right-click the file and select Modify from the Context menu.
8. Enter A00 in the Value Data text box and click OK.

Important:

If your workstation runs on a 64-bit system, you must also perform steps 5-8 for the following key:

Add a registry key for the TLS directories

To add registry keys for TLS versions 1.1 and 1.2, perform the following steps:

1. Navigate to the following registry path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1
2. Select the Client key.
3. From the Menu bar, click Edit, select New, and click DWORD (32-bit) Value.Reminder: On 64-bit systems, click QWORD (64-bit) Value.
4. Enter DisabledByDefault as the DWORD value’s name.
5. Right-click the file and select Modify from the Context menu.
6. Enter 0 in the Value Data text box and click OK.
7. Navigate to the TLS1.2 registry path and open the Client key.
8. Repeat steps 2-6 and click OK.

Apply the settings.

After you modify your registry keys, you must restart your workstation to apply the registry settings. When your workstation restarts, create a test email account in Microsoft Outlook and configure the following settings in the Advanced section of Microsoft Outlook’s Internet E-Mail Settings interface:

• Enter 993 in the Incoming Server (IMAP) text box or 995 in the Incoming Server (POP3) text box.
• Enter 465 in the Outgoing Server (SMTP) text box.

After you finish, click OK. Your Microsoft Outlook account will now successfully connect to your cPanel server’s mail services.

Installation scripts

We created two scripts that will automatically perform the actions that this document describes. To use these scrtps, perform the following steps:

1. Open the Windows PowerShell application.
2. Navigate to the directory of you choice.
3. Create the install-kb.ps1 and tls-reg-edit.ps1 files.
4. Open the install-kb.ps1 file with a text editor and add the following information: Click to view…
5. Open the tls-reg-edit.ps1 file with a text editor and add the following information: Click to view…
6. Run the scripts from the directory in which you saved the files, for example: Set-ExecutionPolicy Bypass -Scope Process ; .\install-kb.ps1Set-ExecutionPolicy Bypass -Scope Process ; .\tls-reg-edit.ps1
7. Restart your workstation for the changes to take effect.