A fatal error occurred while creating a TLS client credential.

Mathias Ottsen 121

Hey guys,

I've created restrictions on our client devices so that they are only allowed to use TLS 1.2

Now in the event viewer i see tons of error messages:

"A fatal error occurred while creating a TLS client credential. The internal error state is 10013."

From a couple of google search (primarily https://learn.microsoft.com/en-us/dotnet/framework/network-programming/tls#systemdefaulttlsversions) i've tried the following:

Creating the TLS 1.2 key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2
Create subkeys for Client and Server with: DisabledByDefault 0 & Enabled 1

Created dword entries for .net 32 and 64 bit: 'HKLM:\SOFTWARE\WOW6432Node\Microsoft.NETFramework\v4.0.30319' / 'HKLM:\SOFTWARE\Microsoft.NETFramework\v4.0.30319' -name 'SystemDefaultTlsVersions' -value '1' and SchUseStrongCrypto '1' - Steps repeated for each .net framework key v1.0, v2.0.50727 and forth.

As an example

Our devices are running Windows 10 Enterprise edition. I've tried to test the changes on my device which is running 20H2.

Anyone with an idea of how i can proceed with the troubleshooting?

Miguel Angel Crespo 10 Reputation points

2023-04-20T11:54:51.6433333+00:00

Hi,
the value in the TLS 1.2/Client MUST BE ffffffff in Hex or (4294967295) in decimal.
Arnie Spitzmacher 0 Reputation points

2023-05-05T17:38:54.39+00:00

@Miguel Angel Crespo The Hex value of ffffffff for the DisabledByDefault or Enabled KEY?
Janne Kujanpää 266 Reputation points

2023-06-26T16:02:08.9866667+00:00

Is there documentation or other sources for "ffffffff in Hex or (4294967295)"?

https://learn.microsoft.com/en-gb/dotnet/framework/network-programming/tls?WT.mc_id=Portal-Microsoft_Azure_Security#configuring-schannel-protocols-in-the-windows-registry Stated 1 to be correct value for DisabledByDefault and Enabled
Nick M. Kulkarni 26 Reputation points

2023-10-05T12:33:07.21+00:00

@Janne Kujanpää

The documentation conflicts you can find both 1 and ffffffff in MS Documents.

What I can tell you is that the ffffffff value is what is set by Nartac's IIS Crypto.

I decided to run a test on my own machine and setting 1 for enabled caused TLS to fail in my browser. Putting it back to ffffffff removed the problem.
Nathan 0 Reputation points

2026-09-15T16:06:56.98+00:00

If you are using Centralized Certificate Store the service account you configured it to use needs "Log on as batch job" rights.
secpol.msc -> Local Policies -> User Rights Assignment -> Log on as batch job -> add your service account

15 answers

CommadoreVic20 1 Reputation point

2022-09-01T19:41:19.067+00:00

i spoke too soon it just crashed right in front of me :(
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Anonymous

2022-09-01T17:27:28.897+00:00

My L3 support is thinking it has to do with Windows 10 20H2 and upgrading to 21 will fix this. Updating drivers 1 by 1 to fix the issue until the new OS is pushed to all our laptops.
Was this answer helpful?

1 person found this answer helpful.
CommadoreVic20 1 Reputation point

2022-09-01T19:51:06.603+00:00

my effected system is on 21H2 19044.1889 so not sure about upgrading will fix :(

daveouel 21 Reputation points

2023-10-06T16:36:54.61+00:00

I did read on a techhub, that large networks, that contain lots of servers and a large amount of client devices, there is likely to be servers, using only IPv4 or IPv4 and IPv6, this will generate TLS errors due to the mismatch of IPv4 and IPv6.. testing from a client, disable IPv4 test, then switch to IPv6 and test-
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Eke Dubois 6 Reputation points

2022-08-31T15:42:34.097+00:00

Same here @Joakim Bergquist

Post Windows updates, more systems are being affected. Crashing suddenly. Need a fix.
Was this answer helpful?

1 person found this answer helpful.
Anonymous

2022-09-01T04:59:57.673+00:00

It's wild I just ran into this comment that you seem to be having this same issue right now. My L2 support can't seem to figure it out so while I wait for L3 or L4, I figured I'd try to troubleshoot myself. Not happy, but am somewhat comforted to see that this seems to be a windows problem and not a hardware issue as my laptop was just replaced 1 day ago.

CommadoreVic20 1 Reputation point

2022-09-01T14:47:29.803+00:00

same here, i thought it was a hardware thing and even re installed windows

Mark Minniefield 1 Reputation point

2022-09-01T16:24:38.99+00:00

Did reinstalling the OS fix the issue?

CommadoreVic20 1 Reputation point

2022-09-01T17:17:28.843+00:00

i did not come in this morning to see a crashed computer so that was a good sign. btw i did an in-place install where i didnt loose anything
the one thing i did do was check all the "use TLS" boxes including the experimental one
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Joakim Bergquist 6 Reputation points

2022-08-03T10:25:29.527+00:00

Any update on this?
It seems to have shown up on our clients after some of the last months KB patches.
We see this on random clients now and it affect our 802.1.x wireless authentication with client certificate.

I have also tried above regfixes etc but nothing seem to help. Microsoft Enterprise support was not very helpful.
Was this answer helpful?

2 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Limitless Technology 40,116 Reputation points

2022-02-15T23:06:31.54+00:00

Hi @Mathias Ottsen

"A fatal error occurred while creating a TLS client credential. The internal error state is 10013" occurs when the client and server cannot agree on a mutual cipher to use to establish a secure connection.

If you are having connectivity issues with a specific resource or internet site, for example, then you should review your TLS/SSL settings. These settings can be accessed by running inetcpl.cpl and going to Advanced > Scroll down to Security and note the TLS settings.

Here is a thread as well that discusses the same issue and you can try out some troubleshooting steps from this and see if that helps you to sort the Issue.

A fatal error occurred while creating a TLS client credential. The internal error state is 10013
https://social.technet.microsoft.com/Forums/office/en-US/5966745a-c792-4c3b-b98b-f2db284413d0/a-fatal-error-occurred-while-creating-a-tls-client-credential-the-internal-error-state-is-10013

Hope this resolves your Query!!

--------
--If the reply is helpful, please Upvote and Accept it as an answer--
Was this answer helpful?

2 people found this answer helpful.
Mathias Ottsen 121 Reputation points

2022-02-16T11:14:43.747+00:00

I tried to monitor the traffic by using wireshark. However, it's not showing any blocked entries for older TLS protocols. Then tried to remove the reg keys to see if any changes were to show in my filter, but the only protocol appearing is whitelisted TLS 1.2 traffic, which you can see by the screenshot from the post is allowed.

This is the outcome from inetcpl.cpl:

Would that mean that TLS 1.0 and 1.1 are still enabled somehow?

This is the outcome from the IIS crypto GUI, which shows that they should be disabled:

Dan Yurman 0 Reputation points

2024-12-24T15:11:48.0766667+00:00

I found that TLS 3.0 was not checked. Once I checked it the errors stopped.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

A fatal error occurred while creating a TLS client credential.

15 answers

Your answer