How to confirm via PowerShell that TLS 1.2 is available on the OS?

user_6305105 0
Viewed 13479

In Windows Server 2016 it is possible via Group Policy to disable use of TLS 1.2.

We would like to add a check to our installer script in PowerShell to see if TLS 1.2 is available. Note that this is different than checking if a URL uses TLS 1.2, or if TLS 1.2 is enabled in the current PowerShell session. We would like to check if TLS 1.2 is available from the OS or if it has been disabled through administrator Group Policy configuration.

Does anyone know how to do this? Any help would be greatly appreciated. Has not been great info online on the subject.

tls1.2 powershell
2 Answers

Use the following:

$available = try {
  $orig = [Net.ServicePointManager]::SecurityProtocol
  [Net.ServicePointManager]::SecurityProtocol = 'Tls12'
  [bool] [System.Net.WebRequest]::Create('https://example.org/')
} catch {
  $false
} finally {
  [Net.ServicePointManager]::SecurityProtocol = $orig
}
user_453750

If the need is to check if the system has working TLS 1.2 enabled by default:

$tls12 = try {
  $resp = (New-Object System.Net.WebClient).DownloadString("https://tls-v1-2.badssl.com:1012/")
  [bool] $resp.Contains("green")
} catch {
  $false
}
user_27162180
Related