Set TLS/SSL security policy for IPP printers

Policy ID: ConfigureIppTlsCertificatePolicy
Scope: Computer Configuration
Supported on: At least Windows 11 Version 24H2
Source: Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
Category: Printers

Description

Determines the TLS/SSL security policy (WINHTTP_OPTION_SECURITY_FLAGS) for printers using the Microsoft IPP Class Driver.

By default, security policy is set to ignore all certificate errors, allowing use of self-signed certificates for printers.

If you enable this setting the system defaults to enabling all certificate checking, disallowing certificate errors. Specific certificate checking can be set with the given checkboxes.

If you disable this setting or do not configure it, the default is to ignore all certificate errors (all checkboxes unchecked).

Options

The empty box and the checked box tell the checkbox items of the Group Policy editor apart (a checked box is an item that is selected by default).

Disallow invalid certificate authority
Disallow non-server certificates
Disallow invalid certificate common name
Disallow invalid certificate date

Registry

ComputerHKEY_LOCAL_MACHINE

HKLM\Software\Policies\Microsoft\Windows NT\Printers\IPP View registry values

SecurityFlagsBlockUnknownCAREG_DWORD
SecurityFlagsBlockCertWrongUsageREG_DWORD
SecurityFlagsBlockCertCNInvalidREG_DWORD
SecurityFlagsBlockCertDateInvalidREG_DWORD

Other policies in the same category

View all policies in this category (46)