Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to configure IIS 7.5 (Server 2008 R2) to be FIPS 140.2 compliant.

Specifically, this involves disabling all SSL protocols other than TLS 1.0.

I have set the following registry keys:

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server

to Enabled(DWORD) = 0 as per this KB, but SSL Labs' checker says "SSL 2.0+ Upgrade Support" is enabled. (Everything other than that and TLS 1.0 is not available, so we're getting somewhere). It also says "FIPS ready - no" - presumably because SSL 2.0+ Upgrade Support is still enabled.

serversniff.net says SSL 2.0 is turned off, and doesn't say anything about SSL 2.0+ Upgrade Support. Could this be an anomaly with SSL Labs' checker?

share|improve this question
    
it might be easiest to contact Ivan (the SSL Labs developer) to figure out what exactly that means. Based on the following link, I have a feeling it is because IIS is throwing a 500 error when a SSLv2 connection is attempted, but not sure. blog.ivanristic.com/2009/08/… –  MattB Jun 4 '10 at 15:13

3 Answers 3

up vote 2 down vote accepted

It means that the server supports SSLv2 handshake, even though it may not support SSLv2 itself. Essentially it's an optimization. Instead of a client first requesting SSLv2 (with a SSLv2 handshake) and failing (if the server does not support it), then having to request SSLv3 or better (with a SSLv3 handshake), the client can use the SSLv2 handshake to indicate support for newer protocols.

http://sourceforge.net/mailarchive/forum.php?thread_name=20100629171623.43012oj4b2hgrzi8%40webmail.mxes.net&forum_name=ssllabs-discuss

share|improve this answer

You can confirm that it is an issue with the SSL Labs Checker by changing the configuration in your browser to only accept SSL 2.0. If you can connect to your site, then SSL 2.0 is still enabled. Otherwise, it is disabled.

share|improve this answer

A company called Nartac software makes a free IIS Crypto configuration tool that can be used to enable/disable protocols and cipher suites in IIS on Windows 2003, 2008 and 2012. It also comes with templates for configuring IIS to be FIPS 140.2 compliant, integrates with the Qualys SSL site analyzer for testing public urls, and has a list of other validation tools that can be used to validate internal sites.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.