Features

• Single click to secure your website using Best Practices
• Backup the registry before making any updates
• Change advanced registry settings
• Built in Best Practices, PCI 4.0, Strict and FIPS 140-2 templates
• Create custom templates that can be saved and run on multiple servers
• Revert to the original server's default settings
• Enable TLS 1.1, 1.2 and 1.3*
• Enable HTTP/3 with QUIC*
• Enable forward secrecy
• Reorder cipher suites
• Disable weak protocols and ciphers such as SSL 2.0, 3.0, MD5 and 3DES
• Stop DROWN, logjam, FREAK, POODLE and BEAST attacks
• Site Scanner to test your configuration
• Command line version
• Logging for all changes
• View current settings

*TLS 1.3 and HTTP/3 with QUIC requires Windows Server 2022 or later.

What Does IIS Crypto Do?

IIS Crypto updates the registry using the same settings from this article by Microsoft. It also updates the cipher suite order in the same way that the Group Policy Editor (gpedit.msc) does. Additionally, IIS Crypto lets you create custom templates that can be saved for use on multiple servers. The command line version contains the same built-in templates as the GUI version and can also be used with your own custom templates. IIS Crypto has been tested on Windows Server 2012 R2, 2016, 2019, 2022 and 2025.

IIS Crypto requires administrator privileges. If you are running under a non-administrator account, the GUI version will prompt for elevated permissions. The command line version must be run from a command line that already has elevated permissions.

Downloads

IIS Crypto is offered in both a GUI and a command line version. Click here to choose your version and download.

Custom Templates

IIS Crypto allows you to create your own custom templates which can be saved and then executed on multiple servers. To create your own template, select all of the settings for your configuration. Click on the Templates button and give your template a name, author and description if desired. Then click on the Save button to save your template to disk. Copy your template to another server, run IIS Crypto and click on the Open button to load your template. You can also use it from the command line version of IIS Crypto.

Load the Best Practices template before you start customizing your own template to ensure your template is setup securely. If your template is in the same folder as IIS Crypto it will show up automatically in the drop-down box without having to click the Open button first.

Command Line Help

The following are the switches for the command line version of IIS Crypto. All parameters are optional.

Here is an example that backs up the registry to a file named backup.reg, applies a custom template named MyServers.ictpl and reboots the server:

iiscryptocli /backup backup.reg /template "C:\temp\MyServers.ictpl" /reboot

Here is an example that shows all current settings and logs them to a file:

iiscryptocli /log settings.log /view

Support

Please take a look at our FAQ. If you have any other questions, feel free to contact us.

Test Your Site

To test your site after you have applied your changes, click the Site Scanner button, enter in the URL and click the Scan button. You can also scan online from here:

Additional Information

Here are some additional resources you may find useful:

• Default cipher suite order for all Windows Server versions
• List of all cipher suites supported in each version of Windows
• Additional cipher suites supported in Windows Server 2008 R2 and above with updates applied
• SSL/TLS Best Practices
• DROWN attack
• logjam information
• POODLE information
• FREAK information