Just found that SSLv2 is enabled in IIS 7.5 by default and to change it requires tweaking in registry. What is the design decision for it? Is there a disadvantage of disabling it?
Add a comment
|
1 Answer
It's enabled by default in Server 2008 R2 for backwards compatibility for really ancient client applications.
For most web servers, all client browsers support at least SSLv3; SSLv2 can be safely disabled.
answered Dec 9, 2013 at 18:19
