Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a mvc3 website that is hosted on a Server 2008 r2 server and I have a security certificate installed and all seems to be working ok. However if I connect to the site with Google Chrome, and click on the security icon I get this message:

The connection uses SSL 3.0.

The connection is encrypted using RC4_128, with SHA1 for message authentication and RSA as the key exchange mechanism.

The connection is not compressed.

The connection had to be retried using SSL 3.0. This typically means that the server is using very old software and may have other security issues.

The last statement is the one that bothers me. I know this is only an issue with Chrome and hopefully isn't an actual security problem but I went to several other https sites and they all say The connection uses TLS 1.0. and no other error/warning information. So I would like my site to use TLS.

My understanding is that IIS 7 negotiates a protocol that both the server and client have in common and in this order of preference:

1: PCT 1.0

2: SSL 3.0

3: SSL 2.0

How would I go about adding TLS 1.0 to this and to be the first choice? I have seen Microsoft's brief about disabling protocols but I want to support them all just in case a client can't.

Perhaps the 'SSL 3.0' is not the cause of this, however it is that the connection had to be retried, if so why was it retried and how can I fix it? The mvc3 site uses [RequireHttps] on all (most all) the controller classes, could this have anything to do with it?

share|improve this question
    
You should disable SSLv2.0 (and PCT 1.0) anyway, browsers that don't support them are certainly more than 10 years old. Have you tried the methods presented in these links (to enable/disable protocols)? serverfault.com/q/314874/47187, support.microsoft.com/kb/187498 and support.microsoft.com/kb/245030 –  Bruno May 16 '12 at 13:30
add comment

migrated from stackoverflow.com May 15 '12 at 22:33

This question came from our site for professional and enthusiast programmers.

1 Answer

Your understanding of cipher negotiation at a high level is correct. For more information on how SSL works: http://security.stackexchange.com/questions/20803/how-does-ssl-work/20847

I hope I am interpreting the actionable task correctly:

You are looking to use and prioritize SSL cipher suites of your choice (TLS 1.0 protocol was mentioned, but which cipher suite was not). It would seem that this free tool (available in both gui and cli) is what you are looking for: https://www.nartac.com/Products/IISCrypto/Default.aspx

There are additional details on that page for further reading as well.

Note: I am no way affiliated with the tool or the site, but found it in my travels. Simply trying to get you to a working resolution of setting SSL ciphers as you wish.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.