Powershell Enable-TlsCipherSuite

Question

I am looking to enable TLS ciphers on a Windows 10 Pro 21h1 Operating system. I am planning to use the following PowerShell commands and apply these to multiple devices via an MDM solution.

Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" -position 0
Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" -position 1

Does it matter what position these appear in the array of ciphers? I read over the MSFT docs and I do not see anything mentioned about positioning requirements.

MisterSmith · Accepted Answer · 2021-12-17 00:53:52Z

3

Yes Cipher order is important, Get-TlsCipherSuite returns an ordered list. That order is respected when the server is negotiating a cipher to use. You want to ensure your strongest ciphers at the top of the list, and any weaker ones you need to support are at end of the list (and its generally a good idea to remove all the really weak ones eg Disable-TlsCipherSuite -Name 'TLS_RSA_WITH_NULL_SHA')

Calling Enable-TlsCipherSuite with -position 0 will insert the new Cipher at the top of the list. Calling Enable-TlsCipherSuite without the -position param (or specifying -position 4294967295) will append the Cipher Suite to the end of the list.

answered Dec 17, 2021 at 0:53

MisterSmith

3,7041 gold badge12 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Powershell Enable-TlsCipherSuite

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related