1

I need to disable SSL 2.0 support on a Windows Server 2003 server (running IIS 6.0). Specifically, I'd like to be able to disable on a single website. Is this possible or do I have to disable it globally by editing the registry?

2 Answers 2

2

Microsoft has a knowledge base entry for this. It involves editing the registry and I believe it is a global change. I do not think it is possible to do this for a single website.

2
  • I've seen that article. We are hosting numerous sites on one of our servers - I just don't know if I'm comfortable disabling SSL 2.0 globally. Do you know if there are any possible repercussions?
    – sestocker
    May 8, 2009 at 12:33
  • Disabling ssl2 is a best practice...
    – mahnsc
    Mar 29, 2011 at 2:57
0

You should disable both SSL 2.0 and SSL 3.0 and also PCT 1.0 and TLS 1.0. To be able to this you need entries to those protocols (both server and client) in your registy. These are not available by default and here on this official Microsoft page you can read on how to add those entries and disable the functionality.

But to make your life easy. You can also paste the following lines in a .reg file and run it:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]
"DisabledByDefault"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"DisabledByDefault"=dword:00000000

The entries will be created for you and only TLS 1.1 and TLS 1.2 will be enabled and all other (insecure) protocols will be disabled.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .