Bug ID 1073933: VPN not working using Ciphers after install registry key for allowed TLS 1.3 on Windows client

Last Modified: Apr 28, 2025

Affected Product(s):
APM-Clients APM(all modules)

Known Affected Versions:
7.2.2, 7.2.2.1, 7.2.2.2, 7.2.3, 7.2.3.1, 7.2.4, 7.2.4.2, 7.2.4.3, 7.2.4.4, 7.2.4.5, 7.2.4.6, 7.2.4.7, 7.2.4.8

Fixed In:
7.2.5

Opened: Jan 19, 2022

Severity: 3-Major

Symptoms

VPN connection not establishing if using these ciphers: AES128-GCM-SHA256 AES128-SHA AES256-GCM-SHA384 AES256-SHA Microsoft restricts using these Ciphers after adding the registry key to allow TLS 1.3

Impact

Clients who installed the registry key for allowing tls 1.3 will not able to use these ciphers: AES128-GCM-SHA256 AES128-SHA AES256-GCM-SHA384 AES256-SHA

Conditions

On Windows 10/11 installed registry key for allowed tls 1.3 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client] "DisabledByDefault"=dword:00000000 "Enabled"=dword:00000001

Workaround

Delete the registry key that allows tls 1.3

Fix Information

Added support for AES128-GCM-SHA256 cipher in TLS1.3 for Windows VPN clients

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips