Enabling TLSv1.1 and TLSv1.2 for Bitdefender updates

This article applies to:

• Bitdefender for Marshal

Question:

• How do I ensure that Bitdefender updates can use TLSv1.1 or above?

Background:

The mirror server for Bitdefender for Marshal update will soon stop accepting SSL requests over TLSv1.0. TLSv1.0 is a deprecated older version of TLS.

• As of October 1, 2018, organizations that must consider the PCI DSS guidelines are required to remove TLSv1.0 from their servers. This date reflects a grace period for a new standard that came into force after June 30, 2018.
• This requirement includes Trustwave.
• All organizations should be minimizing use of TLSv1.0.
• If you have not enabled TLSv1.1 and TLSv1.2 you may find that other services are unable to connect.

Procedure:

This article outlines the basic requirements and procedures. Note that these are Windows system configuration items. Trustwave has provided this article in good faith but Trustwave is not responsible to provide support for Windows configuration issues.

For All Windows Servers:

Ensure that TLSv1.1 and TLSv1.2 are enabled for client communications.

• You must make Registry changes and restart the server to apply them.
• A helpful free application is IISCrypto by Nartac Software.

For Older Windows Servers:

This information applies to Windows 2008, Windows 2008 R2, and Windows 2012.

Bitdefender updates use the WinHTTP component. You must ensure this component is updated, and then make a registry entry.

1. Ensure that the server has the latest Service Pack and all Windows Updates applied. Check manually until no further updates are available.
2. Ensure that the installed updates include the TLS update. If this update is not applied then apply it manually.
   • For Windows 2008 R2 and 2012, see Q3140245.
     • Follow the instructions in Q3140245 to apply the "default secure protocol" registry flags required
     • For TLSv1.1 and TLSv1.2 only, the value is 0x00000A00
     • For TLSv1.0 through TLSv1.2, the value is 0x00000A80 
   • For Windows 2008, see Q4019276. Microsoft does not state that the "default secure protocol" flags are required on this operating system.

FAQ:

• Why does the Bitdefender for Marshal updater require these system changes to connect over newer TLS?
  • The Bitdefender update component (provided by Bitdefender) uses the WinHTTP component for Web access. WinHTTP is part of the Windows operating system. Older Windows versions and older versions of WinHTTP did not enable use of TLSv1.1 or above.
• Do other Trustwave updaters require any changes?
  • No, current supported versions of SEG, WebMarshal, and Trustwave anti-virus plugins will not require changes. These products support TLSv1.1 and TLSv1.2 using third party components for Web access and are not affected by the WinHTTP issue.
  • Some customers may be using older versions of the products. Customers may need to upgrade to the latest version. Known minimum versions are:
    • SEG: Any supported version (7.5.5 and above when this article was reviewed) 
    • WebMarshal: 6.12 or above (as previously communicated)
    • ECM: 7.2 or above.
    • Sophos for Marshal: 1.1.1 or above
    • McAfee for Marshal: 6.1.1 or above
    • Kaspersky for Marshal: any release

Notes:

The above process may require multiple system restarts.