6

With the announcement of POODLE, I would like my servers to accept SSL3.0 connections but have them serve a page which indicates that the user should update to a newer browser with TLS support. It seems like this should be possible as IIS should know which cipher suite is being used, but I can not figure out any way to configure this information to either allow for hosting different content or being forwarded on to the site itself to do something with.

Is there a way to make IIS either redirect based on the cipher suite used during SSL/TLS negotiation or a way to make information about the cipher suite available to the site?

1 Answer 1

7

SSL / TLS negotiation happens inside https.sys, outside of IIS. By the time the traffic gets to IIS all the encryption-related work has been done.

I'm not aware of any API that exposes the negotiated protocol to IIS-based applications. You could always try to grab it from another source, but I suspect that will prove dodgy, at best.

Logging Schannel success events will generate event ID 36880 events that show the negotiated parameters, but Microsoft didn't bother including the client IP address in these log entries (at least, not that I'm seeing). (That would have been nice but, yet again, Microsoft doesn't bother including IP addresses in Event Logs... Grrrr!)

You could run a packet capture into a ring buffer, looking for SSL 2.0 negotiations and logging them into some kind of persistent store. Your application could query that store, correlate the client IP address to the negotiation log, and proceed to your warning. I suppose that's a feasible practice but that really seems like a lot of work (and "moving parts") to accomplish very little. (It does sound like something fun to write, though...)

1
  • 1
    Yeah, that's far too involved for what really is just intended as a PSA rather than failing the authentication outright. This seems to confirm what I'd been thinking was the case though and gave a few ideas I hadn't thought of even if they are too elaborate to be practical. I'll leave it open for a little while to see if anyone else responds with ideas, but if not, this seems like a solid answer. Oct 15, 2014 at 19:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .