I'm going through PCI compliance check and disabling all SHA1 ciphers on the server. The problem I am running into is Firefox seems to not work unless I have at least one SHA1 cipher enabled. Strange thing is when I go by their documentation Firefox should support other cipher suites out there. Possibly it might be the order I have the suites in. Any suggestions on the proper order to remove all SHA1 Cipher Suites would be greatly appreciated. Running Windows Server 2012 IIS 8.5 Using IIS Crypto 2.0 heres a screenshot of the setup I have going. the highlighted one is the only one that seems to get Firefox to work
-
Are you certain you need to disable SHA1 HMAC for PCI compliance?– garethTheRedMar 16, 2018 at 18:52
-
According to the Compliance team at work they say to be PCI Compliant you have to remove SHA1– scripter78Mar 17, 2018 at 0:10
-
It might be worth clarifying whether the compliance team has mixed up SHA1 HMAC with SHA1 signatures on X509 certificates. The latter have been deprecated.– garethTheRedMar 17, 2018 at 7:40
Add a comment
|