How to make TLS the preferred secure connection in IIS 7

Question

I have a mvc3 website that is hosted on a Server 2008 r2 server and I have a security certificate installed and all seems to be working ok. However if I connect to the site with Google Chrome, and click on the security icon I get this message:

The connection uses SSL 3.0.

The connection is encrypted using RC4_128, with SHA1 for message authentication and RSA as the key exchange mechanism.

The connection is not compressed.

The connection had to be retried using SSL 3.0. This typically means that the server is using very old software and may have other security issues.

The last statement is the one that bothers me. I know this is only an issue with Chrome and hopefully isn't an actual security problem but I went to several other https sites and they all say The connection uses TLS 1.0. and no other error/warning information. So I would like my site to use TLS.

My understanding is that IIS 7 negotiates a protocol that both the server and client have in common and in this order of preference:

1: PCT 1.0

2: SSL 3.0

3: SSL 2.0

How would I go about adding TLS 1.0 to this and to be the first choice? I have seen Microsoft's brief about disabling protocols but I want to support them all just in case a client can't.

Perhaps the 'SSL 3.0' is not the cause of this, however it is that the connection had to be retried, if so why was it retried and how can I fix it? The mvc3 site uses [RequireHttps] on all (most all) the controller classes, could this have anything to do with it?

Answer 1

Your understanding of cipher negotiation at a high level is correct. For more information on how SSL works: https://security.stackexchange.com/questions/20803/how-does-ssl-work/20847

I hope I am interpreting the actionable task correctly:

You are looking to use and prioritize SSL cipher suites of your choice (TLS 1.0 protocol was mentioned, but which cipher suite was not). It would seem that this free tool (available in both gui and cli) is what you are looking for: https://www.nartac.com/Products/IISCrypto/Default.aspx

There are additional details on that page for further reading as well.

Note: I am no way affiliated with the tool or the site, but found it in my travels. Simply trying to get you to a working resolution of setting SSL ciphers as you wish.