Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Anyone know how to disable certain SSL versions and only enable others in IIS 7.5?

share|improve this question
    
Disabling SSL 2.0 sounds like a really bad idea; are you sure you want to do this? –  blueberryfields Jan 5 '10 at 7:18
5  
@blueberryfields: SSLv2 is ancient, current version is TLSv1.1 (TLSv1=SSLv3), and has known security holes –  LapTop006 Jan 5 '10 at 11:58
10  
Disabling SSL 2.0 is a very good idea (and required to pass a PCI compliance test). –  Robert Jan 5 '10 at 15:01

2 Answers 2

  1. Open regedit
  2. Navigate to, or create the keys as necessary:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
    
  3. Create/Edit the value Enabled, type DWORD, value "0"

  4. Reboot

Notes: The same proceedure applied to key names PCT 1.0, SSL 2.0, SSL 3.0, TLS 1.0. In newer versions of Windows some of these are disabled by default - which depends on what version.

Reference: http://support.microsoft.com/kb/187498

share|improve this answer

This is something you need to fix in regedit,

regedit can be opened with "start", "run", regedit

once there, find this entry:

HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0

Right-click on the SSL 2.0 folder and select New and then click Key. Name the new folder Server.

Inside the Server folder, click the Edit menu, select New, and click DWORD (32-bit) Value.

Enter Enabled as the name and hit Enter.

Ensure that it shows 0x00000000 (0) under the Data column (it should by default). If it doesn't, right-click and select Modify and enter 0 as the Value data.

Restart the computer.

a nice explanation can be found here, including how to disable other weak ciphers

https://www.sslshopper.com/article-how-to-disable-ssl-2.0-in-iis-7.html

share|improve this answer
    
and now, I guess we have to start disabling SSLv3.0 also –  Sverre Oct 17 at 3:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.