Enable TLS 1.2 on Windows Server

Microsoft requires TLS 1.2 for its APIs, and older versions of Windows Server do not enable it by default for .NET applications. Any CtrlDocs product that calls Microsoft — CtrlShare, CtrlSync, CtrlTMS — fails to connect on such a server, usually with an error that names the connection rather than the protocol.

This changes four registry keys on the M-Files server. It affects every .NET application on that machine, not only M-Files.

Before you start

• Administrative access to the M-Files server, and permission to edit the registry on it.
• A window in which the M-Files server can be restarted. The change does not take effect until it is.
• Confirmation that this is actually the problem. A working server needs none of this; see Check below for how to tell.

Steps

1. Open the registry editor on the M-Files server.

2. Set these values under both .NET Framework keys. This covers 32-bit applications on a 32-bit operating system and 64-bit applications on a 64-bit one.

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727
     SystemDefaultTlsVersions  dword:00000001
     SchUseStrongCrypto        dword:00000001
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319
     SystemDefaultTlsVersions  dword:00000001
     SchUseStrongCrypto        dword:00000001

3. Set the same values under the Wow6432Node keys, which cover 32-bit applications running on a 64-bit operating system.

   HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727
     SystemDefaultTlsVersions  dword:00000001
     SchUseStrongCrypto        dword:00000001
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319
     SystemDefaultTlsVersions  dword:00000001
     SchUseStrongCrypto        dword:00000001

   If you are not sure which of the two sets applies, set both. Setting the ones that do not apply has no effect.

4. Restart the M-Files server. Restarting the whole machine is the safer choice, because other services on it are affected by the same change.

What these values do

SystemDefaultTlsVersions tells a .NET application to use the operating system’s protocol choice rather than a hard-coded old default. SchUseStrongCrypto removes the weak cipher suites from what it will negotiate. Together they let .NET Framework applications on the server negotiate TLS 1.2.

Check

The product that was failing connects. If it still does not, the problem was not TLS: check the credentials and the permissions on the application registration instead.

On a server where TLS 1.2 was already enabled, nothing changes — which is why setting these values is a reasonable thing to do speculatively when a connection fails for no obvious reason.