Prerequisites

Network ports

No new network ports are used after enabling TLS; instead the standard ports are used securely. The only potential exception is the Discover Data Service. The Data Service uses port 23000 by default but an option to use port 23443 instead was introduced in an earlier fix pack. At the time this option offered additional security, but this is no longer necessary from version 12.1.8. If port 23443 is in use, the configuration should be updated to use port 23000 instead, before trying to enable TLS in version 12.1.8.

Windows registry - TLS 1.2 support in Windows 2008 R2

For TLS security to work, Windows itself must support TLS 1.2. Windows 2012 and 2012 R2 support TLS 1.2 by default. In Windows 2008 R2 the following registry entries must be present:

HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\SendTrustedIssuerList = 0
HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS1.2\Server\DisabledByDefault = 0
HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS1.2\Server\Enabled = 1
Note: A reboot is required for any changes to these entries to take effect.

Windows registry - Discover configuration

If the Windows registry contains an existing Discover TLS configuration entry, it must be set to disabled (0). An "EnableTLS" entry may be present if the customer configured some of the optional security features.

HKLM:\SOFTWARE\Wow6432Node\HCL Discover\EnableTLS = 0

If the earlier "EnableTLS" option is present it must be set to 0.