Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been tasked with configuring an IIS7 server to accept TLS 1.0 HTTPS connections only.

I have come up with the following list of cipher suites which I have deduced are TLS 1.0.


I have put that list in the box in the following policy: Computer Configuration | Administrative Templates | Network | SSL Configuration Settings | SSL Cipher Suite Order

Is that sufficient? Are any of the suites in my list not TLS 1.0? Are there any other TLS 1.0 suites supported by IIS7 that aren't in the list?

The server, by the way, is Windows Server 2008 R2.


share|improve this question
up vote 1 down vote accepted

Limiting the ciphersuites is not the right method, as they could be negotiated by SSLv3 client as well, which will result in SSLv3. The best way is to follow the article Robert pointed to ( and set the proper registry keys. Anything other than that is prone to errors.

share|improve this answer

A company called Nartac software makes a free IIS Crypto configuration tool that can be used to enable/disable protocols and cipher suites in IIS on Windows 2003, 2008 and 2012. It also comes with templates for configuring IIS to be FIPS 140.2 compliant, integrates with the Qualys SSL site analyzer for testing public urls, and has a list of other validation tools that can be used to validate internal sites.

share|improve this answer

You will follow a similar procedure to except you will disable more than just SSL 2.0 also has info

share|improve this answer

Check this out Restrict the website for a particular Crypto Protocol. The same works fine for IIS 7 / 7.5.

share|improve this answer

List of all supported cipers in win2008. It could be a good start.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.