Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've disabled SSLv2 and SSLv3 is on. However I cannot connect to a remote server which fails with

The client and server cannot communicate, because they do not possess a common algorithm

Ran an SSL check ( on the remote server and ours, and noticed none of the ciphers they accept we have on our server. How can this be configured? (Windows Web Server 2008)

Remote Server Accepted SSL ciphers:


Our server by default accepts:

share|improve this question

If you haven't touched the configuration, strong ciphersuites are enabled by default. The list of default ciphersuites in Vista and Server 2008 is on MSDN.

What you listed are not quite ciphersuite names, as they are missing pieces. AES128-SHA is just part of it. A ciphersuite has few parts - key exchange algorithm, encryption/decryption algorithm, and hmac algorithm, so the AES128-SHA example is missing key exchange algorithm. A proper name will be TLS_RSA_WITH_AES_128_CBC_SHA.

I would recommend for testing publicly reachable web servers.

share|improve this answer
Thanks for the comment. I just thought that might have been the issue as the real problem is: "The client and server cannot communicate, because they do not possess a common algorithm." - msxml6.dll error '80090331' – Igor K Aug 23 '10 at 21:25
The error most likely doesn't come from MSXML.DLL, rather from the security subsystem on Windows. Look in the event log for logs from the "Schannel" component, which implements SSL/TLS on Windows. There might be some clues there. Did you actually resolve the issue? – Nasko Aug 24 '10 at 15:11
No I never managed to resolve this issue. The only workaround was to use ASP.NET's HttpWebRequest component and most importantly, specify this: "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3" – Igor K Aug 24 '10 at 16:34
What is the machine you are trying to authenticate to? If it is publicly reachable, I can take a peek at what it supports and see if there is anything I can spot. – Nasko Aug 24 '10 at 23:11
Thanks Nasko, the remote site has reenabled TLSv1 and the original code all works now. It seems theres no way to force SSLv3 using ServerXMLHTTP. Thanks for all your help. – Igor K Aug 25 '10 at 12:41

I just recently followed these instructions (but for server 2003).

How to Restrict the Use of Certain Cryptographic Algorithms and Protocols

(the regedit section)

(for server 2008 and 2003) How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services

(I kept SSL 3.0 / TLS 1.0)

You have to restart IIS after making these changes.

share|improve this answer

You can find very useful python script on

share|improve this answer
you didn't answer the question asked. – fuero Apr 18 '13 at 9:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.