Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Anyone know how to disable SSLv2 and only enable SSLv3 in IIS 7.5?

Thanks a lot and appreciate any advice in advance

Basically just want SSLv2 to be disabled

share|improve this question
    
Disabling SSL 2.0 sounds like a really bad idea; are you sure you want to do this? –  blueberryfields Jan 5 '10 at 7:18
5  
@blueberryfields: SSLv2 is ancient, current version is TLSv1.1 (TLSv1=SSLv3), and has known security holes –  LapTop006 Jan 5 '10 at 11:58
6  
Disabling SSL 2.0 is a very good idea (and required to pass a PCI compliance test). –  Robert Jan 5 '10 at 15:01
add comment

5 Answers

  1. Open regedit
  2. Navigate to, or create the keys as necessary:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
    
  3. Create/Edit the value Enabled, type DWORD, value "0"

  4. Reboot

Notes: The same proceedure applied to key names PCT 1.0, SSL 2.0, SSL 3.0, TLS 1.0. In newer versions of Windows some of these are disabled by default - which depends on what version.

Reference: http://support.microsoft.com/kb/187498

share|improve this answer
add comment

I just recently had to do this, it requires regedit and a server restart unfortunately. If you follow these instructions it should do the trick.

Do remember the ServerSniff.net step, just to check for weak cyphers.

share|improve this answer
    
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Mark Henderson Jul 7 at 23:54
add comment

This is something you need to fix in regedit,

regedit can be opened with "start", "run", regedit

once there, find this entry:

HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0

Right-click on the SSL 2.0 folder and select New and then click Key. Name the new folder Server.

Inside the Server folder, click the Edit menu, select New, and click DWORD (32-bit) Value.

Enter Enabled as the name and hit Enter.

Ensure that it shows 0x00000000 (0) under the Data column (it should by default). If it doesn't, right-click and select Modify and enter 0 as the Value data.

Restart the computer.

a nice explanation can be found here, including how to disable other weak ciphers

https://www.sslshopper.com/article-how-to-disable-ssl-2.0-in-iis-7.html

share|improve this answer
add comment

Here's an IIS.Net forum discussion about this.

I believe that the above article is appropriate to IIS 7, you just might need to be careful about DWORD/QWORD use with x64 based systems.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.