This will support only TLS version 1.2 while also supporting a slightly wider set of ciphers. If it is necessary to support a wider cipher suite set, then we can also select this right here, ELBSecurityPolicy-FS-1-2-2019-08, without the restricted tag on that.

But we do have a significantly more secure TLS configuration, supporting only TLS 1.2 with strong ciphers. CBC mode is not favored in TLS connections. It is a good practice to disable cipher block chaining mode wherever possible, regardless whether it is AES, 3DES, Camellia, or any other block cipher being used there. 2: Registry Key: Step A: Press Windows + R to open Run window, type regedit in the empty box and click OK to run Registry Editor. Check the User TLS 1.2 checkbox is enabled or disabled. These other ones are all “No.” Our limited set of cipher suites, specifically SSL Labs is complaining because we do support CBC mode (cipher block chaining mode) in AES. 1: Internet Explorer: Open Internet explorer options> Advanced tab>scroll down to the Security section. Scrolling down to see the details, we see that we do only support TLS version 1.2.

Then, look at an updated version of SSL Labs run after our change and we see that it is now graded at an A with “Protocol Support” being all the way up to the top, scoring 100 out of 100 on that. Come back over here to our webpage, refresh a few times, make sure that we’re getting to both webservers, sure enough Webserver-1 and Webserver-2 are showing up.

How to test tls 1.2 connection