Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I believe I have disabled SSL 2.0 on my web server (Windows Server 2003). To make sure that it is now using SSL 3.0, how can I check this?

What is the correct way to disable 2.0 and enable 3.0 on a web server?

share|improve this question
1  
Might belong on ServerFault –  JohnFx Jan 26 '10 at 17:23
    
Oh yea, thanks. –  wahle509 Jan 26 '10 at 17:33

4 Answers 4

IIS will negotiate the SSL version to be used with the client and so should select the highest version that will work with that client. By disabling SSL v2 your are saying that any clients that cannot use V3 will not be able to make an SSL connection, is this what you want?

As far as checking that it is using V3, if you have access to a linux machine (or cygwin on Windows) with openssl installed, you can run this command:

openssl s_client -connect server.com:443 -ssl3

If you can connect, then it is working. Substitute ssl3 for ssl2 if you want to check SSL2.

share|improve this answer
    
What I want is to disable 2.0, so clients are forced to use 3.0 or TLS 1.0. –  wahle509 Jan 26 '10 at 17:59
1  
Thats all very well, but if they client does not support 3.0 or TLS 1.0 then they will not be able to connect –  Sam Jan 27 '10 at 8:49
    
I wouldn't worry too much about clients without SSL v3 / TLS 1.0 support being able to connect. These protocols have been supported in common web browsers since the mid-90's: stackoverflow.com/questions/881563/… –  Andy Holt Sep 24 '12 at 9:43

Here is the official Microsoft documentation on how to disable a specific SSL protocol.

The openssl test is definitely the easiest. There are binary distributions of openssl available for Windows.

share|improve this answer
    
So, if I disable 2.0, clients will be forced to connect using 3.0 or TLS. Right? –  wahle509 Jan 26 '10 at 18:07
2  
That is correct. If a client only supports 2.0 they will not be able to connect. –  MattB Jan 26 '10 at 18:09

The easiest way to verify that SSL 2.0 is disabled is to use http://www.serversniff.net/content.php?do=ssl or https://www.ssllabs.com/ssldb/index.html

share|improve this answer
    
The first link is dead. –  Ricardo Gladwell Oct 15 at 10:25

openssl.exe s_client -connect localhost:443 or

http://www.foundstone.com/us/resources/proddesc/ssldigger.htm http://www.serversniff.net

share|improve this answer
    
How do you use "openssl.exe s_client -connect localhost:443". I don't think I have openssl.exe on the server. Also, I have installed the SSLDigger tool, but don't know how to use it. Any help? –  wahle509 Jan 26 '10 at 17:39
    
wahle509: You can get openssl for windows from here slproweb.com/products/Win32OpenSSL.html –  proy Jan 26 '10 at 19:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.