How to Disable Specific Protocols in dbFront

Question

In order to satisfy a security scan we need to disable the use of TLS 1.1 by dbFront. How do we do this?

Answer 1

As of 1.4.2.0683, dbFront will check the registry to see if a protocol is disabled before using it within dbFront.

The registry key it checks is the following. This key is also monitored by other windows services.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
"Enabled"=dword:00000000

Setting [`Enabled`] to [`dword:00000000`] will disable this protocol.

Any change to this registry key will require a restart of both the dbFront Service and the dbFront Web Application. It is recommended to restart the entire server so that all applications and services including IIS are updated.

NOTE: If your dbFront install is distributed over multiple servers, then all servers will need to be updated accordingly.