Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've disabled SSLv2 and SSLv3 is on. However I cannot connect to a remote server which fails with

The client and server cannot communicate, because they do not possess a common algorithm

Ran an SSL check (http://www.serversniff.net/sslcheck.php) on the remote server and ours, and noticed none of the ciphers they accept we have on our server. How can this be configured? (Windows Web Server 2008)

Remote Server Accepted SSL ciphers:

DHE-RSA-AES256-SHA
AES256-SHA
EDH-RSA-DES-CBC3-SHA
DES-CBC3-SHA
DHE-RSA-AES128-SHA
AES128-SHA 

Our server by default accepts:

DES-CBC3-SHA
RC4-SHA
RC4-MD5
share|improve this question
add comment

3 Answers 3

If you haven't touched the configuration, strong ciphersuites are enabled by default. The list of default ciphersuites in Vista and Server 2008 is on MSDN.

What you listed are not quite ciphersuite names, as they are missing pieces. AES128-SHA is just part of it. A ciphersuite has few parts - key exchange algorithm, encryption/decryption algorithm, and hmac algorithm, so the AES128-SHA example is missing key exchange algorithm. A proper name will be TLS_RSA_WITH_AES_128_CBC_SHA.

I would recommend ssllabs.com for testing publicly reachable web servers.

share|improve this answer
    
Thanks for the comment. I just thought that might have been the issue as the real problem is: "The client and server cannot communicate, because they do not possess a common algorithm." - msxml6.dll error '80090331' –  Igor K Aug 23 '10 at 21:25
    
The error most likely doesn't come from MSXML.DLL, rather from the security subsystem on Windows. Look in the event log for logs from the "Schannel" component, which implements SSL/TLS on Windows. There might be some clues there. Did you actually resolve the issue? –  Nasko Aug 24 '10 at 15:11
    
No I never managed to resolve this issue. The only workaround was to use ASP.NET's HttpWebRequest component and most importantly, specify this: "System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3" –  Igor K Aug 24 '10 at 16:34
    
What is the machine you are trying to authenticate to? If it is publicly reachable, I can take a peek at what it supports and see if there is anything I can spot. –  Nasko Aug 24 '10 at 23:11
    
Thanks Nasko, the remote site has reenabled TLSv1 and the original code all works now. It seems theres no way to force SSLv3 using ServerXMLHTTP. Thanks for all your help. –  Igor K Aug 25 '10 at 12:41
add comment

I just recently followed these instructions (but for server 2003).

How to Restrict the Use of Certain Cryptographic Algorithms and Protocols

http://support.microsoft.com/kb/245030

(the regedit section)


(for server 2008 and 2003) How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services

http://support.microsoft.com/kb/187498

(I kept SSL 3.0 / TLS 1.0)

You have to restart IIS after making these changes.

share|improve this answer
add comment

You can find very useful python script on http://www.thesprawl.org/projects/sslmap/

share|improve this answer
1  
you didn't answer the question asked. –  fuero Apr 18 '13 at 9:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.