I have a mvc3 website that is hosted on a Server 2008 r2 server and I have a security certificate installed and all seems to be working ok. However if I connect to the site with Google Chrome, and click on the security icon I get this message:
The connection uses SSL 3.0.
The connection is encrypted using RC4_128, with SHA1 for message authentication and RSA as the key exchange mechanism.
The connection is not compressed.
The connection had to be retried using SSL 3.0. This typically means that the server is using very old software and may have other security issues.
The last statement is the one that bothers me. I know this is only an issue with Chrome and hopefully isn't an actual security problem but I went to several other https
sites and they all say The connection uses TLS 1.0.
and no other error/warning information. So I would like my site to use TLS.
My understanding is that IIS 7 negotiates a protocol that both the server and client have in common and in this order of preference:
1: PCT 1.0
2: SSL 3.0
3: SSL 2.0
How would I go about adding TLS 1.0 to this and to be the first choice? I have seen Microsoft's brief about disabling protocols but I want to support them all just in case a client can't.
Perhaps the 'SSL 3.0' is not the cause of this, however it is that the connection had to be retried, if so why was it retried and how can I fix it? The mvc3 site uses [RequireHttps]
on all (most all) the controller classes, could this have anything to do with it?