0

In the process of setting up an HTTPS website and in the best practices of it, firstly I disabled ssl v3 (no problem with that) and then I disabled older insecure ciphers and only enabled:

TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384

However, after doing this, I cannot log in anymore via remote desktop. Probably some cipher incompatibility ? The RD client is on Windows XP, the server is windows 2012 R2. How can I solve this ? I don't want to re-enable older insecure ciphers for IIS.

Thank you in advance

2
  • 1
    You don't want to use insecure ciphers but you are using an insecure OS? Windows XP is dead and I guess that's also the cause of your problem.
    – duenni
    Sep 11, 2017 at 11:12
  • duenni windows xp is the OS where the RD client is. That is not my problem Sep 11, 2017 at 11:20

2 Answers 2

1

Older versions of RDP do not support anything above TLS 1.0. There is a patch for Windows 7 and Windows Server 2008 R2 here. Windows 2012 supports this OOTB. TLS 1.1 & TLS 1.2 are enabled by default on post Windows 8.1 releases. Windows XP is EOL, there is no patch. So if you disable TLS 1.0 on the server side you can not connect with a Windows XP client.

2
  • I am not sure I have disabled TLS 1.0. Through registry I only disabled SSL v3. Unless I disabled TLS by removing insecure ciphers ? Sep 11, 2017 at 12:02
  • I am not an expert when it comes to SSL but there are ciphers which are shared between these protocols (meaning ciphers categorized as SSL-ciphers are used in TLS, too). I could not figure out which ciphers are needed for RDP but I guess it's one (or more) of the ciphers you disabled...
    – duenni
    Sep 11, 2017 at 12:25
1

In addition to keeping TLS 1.0 enabled, you also need to enable 3DES if you absolutely must RDP to the server from an XP client.

This is the wrong answer though, the right answer is to use an up to date, secure and supported client OS; currently Windows 7 or newer.

No one should be using Windows XP today except in highly exceptional circumstances, in which case the machine should be air-gapped. You certainly should NOT be using it to administer a web server!!

Not the answer you're looking for? Browse other questions tagged .