I have a website that has just failed a PCI Compliance check - The report said that the site supported weak ciphers. I thought I'd already disabled that by turning off SSL 2.0 on the webservers. (It refuses to load a web page if I tell the browser to use only SSL 2.0)
Is there anything else I need to disable or check? (It is a web farm, is there anything on the load balancer I need to look at - Incidentally, the LB should be simply passing the data through, the encryption/decryption is all done on the web servers)
Windows Server 2003, IIS 6.0, ASP.NET 2.0 web site.
--- Update ---
Having gone through the links supplied by GregD, I have resolved most of the issues. I'm still getting the issue that the certificate is not trusted. The SSL Labs website helpfully gives some hints on why that could be (but otherwise isn't very explicit on the subject):
There are many reasons why a certificate may not be trusted:
- It is used before its activation date (It is in date)
- It is used after its expiry date (It is in date)
- Certificate hostname doesn't match the site (host name and site match)
- It has been revoked (How do I tell?)
- It is self-signed (It's is by verisign)
- The issuer is not a well-known certificate authority (Is verisign well known enough?)
- The certificate chain is incomplete (How do I tell?)
Firefox seems to get on okay with the certificate, putting up a nice green area on the address bar.