TLS Hardening

[Wander-0000]

Hi all,

I'm looking into hardening TLS on our Windows 11 devices using the Intune Settings Catalog policy Cryptography > TLS Cipher Suites.

I'm currently testing the following suites:

• TLS_AES_256_GCM_SHA384
• TLS_AES_128_GCM_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

So far, testing looks good. Has anyone deployed a similar configuration in production? Any compatibility issues with VPN clients, printers, network devices, or management interfaces?

If the results remain positive, this might be a nice optional addition to the Open Intune Baseline. Curious to hear your experiences.

[markvonk]

I use the same type of config, but with:

• TLS_AES_256_GCM_SHA384
• TLS_CHACHA20_POLY1305_SHA256
• TLS_AES_128_GCM_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS_CHACHA20_POLY1305_SHA256 is used in TLS 1.3 BTW (which is the only one I added more than you did)

I have had no issues whatsoever, but your mileage may vary as we do not have any legacy stuff and are Cloud only. Other companies and organizations might have legacy devices and interfaces that still use older cipher suites and TLS versions....