CRITICAL

Solved: SSL/TLS Handshake Failed in Windows Server 2025 IIS

Quick Fix Summary

TL;DR

Restart IIS, verify certificate binding, and enable TLS 1.2 in the registry.

The SSL/TLS handshake fails when the client and server cannot agree on a secure communication protocol or certificate. This is often due to misconfigured cipher suites, expired certificates, or disabled protocols in Windows Server 2025.

Diagnosis & Causes

  • Expired or invalid SSL certificate binding.
  • TLS 1.0/1.1 is disabled, but client only supports them.
  • Mismatched or weak cipher suites between client/server.
  • System time is out of sync, invalidating certificates.
  • Schannel registry keys are misconfigured or corrupted.

    • Recovery Steps

    1

    Step 1: Immediate Service & IIS Reset

    First, restart core services to clear any transient state and reload configurations.

    bash 
    iisreset /stop
net stop cryptsvc
net start cryptsvc
iisreset /start
    2

    Step 2: Verify Certificate Binding in IIS

    Ensure the correct certificate is bound to the site's HTTPS port (443) and the binding is not corrupted.

    powershell 
    Get-ChildItem -Path IIS:\SslBindings
    3

    Step 3: Enable TLS 1.2 via Registry (Critical for 2025)

    Windows Server 2025 may have stricter defaults. Explicitly enable TLS 1.2 client and server protocols.

    powershell 
    New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'Enabled' -Value 1 -PropertyType 'DWord' -Force
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'DisabledByDefault' -Value 0 -PropertyType 'DWord' -Force
New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'Enabled' -Value 1 -PropertyType 'DWord' -Force
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'DisabledByDefault' -Value 0 -PropertyType 'DWord' -Force
    4

    Step 4: Reorder Cipher Suites for Strong Negotiation

    Prioritize strong, modern cipher suites to ensure a successful handshake with compliant clients.

    powershell 
    $cipherOrder = @('TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384','TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256','TLS_DHE_RSA_WITH_AES_256_GCM_SHA384','TLS_DHE_RSA_WITH_AES_128_GCM_SHA256')
$cipherSuites = [string]::Join(',', $cipherOrder)
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -Name 'Functions' -Value $cipherSuites -PropertyType 'String' -Force
    5

    Step 5: Analyze Schannel Logs for Root Cause

    Enable and check the Windows Schannel event log for specific error codes (like 36887 or 36874).

    powershell 
    Get-WinEvent -LogName 'System' -FilterXPath "*[System[Provider[@Name='Schannel']]]" -MaxEvents 20 | Format-List TimeCreated, Id, Message

    Architect's Pro Tip

    "For Azure-hosted VMs, the platform-managed 'Azure TLS/SSL policy' can override local Schannel settings. Always check it in the VM's Networking blade."

    Frequently Asked Questions

    I enabled TLS 1.2 but still get the error. What's next?

    Run 'nmap --script ssl-enum-ciphers -p 443 your-server.com' from a Linux box. It reveals the exact protocols and ciphers your server offers, often uncovering mismatches not shown in Windows logs.

    Does Windows Server 2025 disable TLS 1.0 by default?

    Yes. Windows Server 2025 has TLS 1.0 and 1.1 disabled by default in the SCHANNEL component. You must explicitly enable TLS 1.2/1.3, as shown in Step 3.

    Related Windows Guides

    0xc000021a

    Root Cause Analysis: Why Windows 11/Server 2022 BSOD STOP 0xc000021a Happens
    0x8007000E

    Root Cause Analysis: Why Windows Update Error 0x8007000E (Out of Memory) Happens
    0x8007000e

    Root Cause Analysis: Why Windows Update Error 0x8007000e Happens