Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For PCI-DSS compliance you have to disable weak ciphers. PCI-DSS permits a minimum cipher size of 128 bits.

However for the highest score (0 I believe) you should only accept 168 bit ciphers but you can still be compliant if you permit 128 bit ciphers.

The trouble is that when we disable all but 168 bit encryption it seems to disable both inbound and out bound secure channels.

For example we'd like to lock down inbound IIS HTTPS to 168 bit ciphers but permit outbound 128 bit SSL connections to payment gateways/services from service applications running on the server (not all payment gateways support 168 bit only we just found out today).

Is it possible to have cipher asymmetry on Windows 2003? I am told it is all or nothing.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I believe it is all or nothing but if you disable the RC2/128 and RC4/128 ciphers, will that help? The 128 but RCx ciphers are considered medium-grade while ciphers like AES-128 are still considered high encryption. (I must confess, I don't know what the scoring system is based on)

share|improve this answer

I use a utility to do this. The RegEdit route was just way too fiddly in the long run.

http://foundeo.com/products/iis-weak-ssl-ciphers/

share|improve this answer
    
Oh, very handy. We mostly do scripted/automated builds but that wee tool will be useful for one-off situations. –  Kev Apr 19 '11 at 13:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.