0

I have two Windows Server 2012 R2 servers, one with IIS, the other with Apache2. They are used as internal web servers, and they have auto-generated, untrusted certificates.

Using Edge browser version 121.0.2277.112, attempting to connect to these web servers using HTTPS returns: ERR_CONNECTION_RESET which seems to be related to a TLS mismatch.

Firefox complains about the certificates, we are able to accept the risk and continue. What can I try to solve the problem ?

Update 1

I installed IIS on another server with the same OS and I can connect to it using Edge. Don't know the details of the TLS protocol but I notices that the client hello is slightly different in this successful case.I suppose it depends on something the server has already said to the client, but I don't know what and where to check.

Update 2

I erroneously wrote the problem was common to 2 windows server. I checked better and it is limited to one of them with WSUS and Trend Micro antivirus server. I summarize what happens: it works well using Firefox, connecting is immediately drop server side using Edge. The server event log is full of errors like this one: An error occurred while using SSL configuration for endpoint 0.0.0.0:443. The error status code is contained within the returned data. Client hello using Firefox or Edge toward other servers is slightly different to the one from Edge to the problematic server, but it is the first message, I cannot understand the source of this difference.

3
  • 2
    Upgrade the servers to use modern TLS ciphers. Feb 12 at 12:43
  • Using Firefox the server hello response shows Cipher suite TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA. It is one of the ciphers proposed by Edge too, so I'm very confused. The major difference I can see is that Firefox says it supports TLS >=1.0, while Edge asks for >=1.2
    – Filippo
    Feb 12 at 14:56
  • Firefox follows web standards, RFC and policies very strictly, where with Edge you might get the Microsoft way. If you have Linux terminal available you could also use this script github.com/noxxi/p5-ssl-tools/blob/master/analyze-ssl.pl
    – Turdie
    Feb 12 at 23:29

1 Answer 1

0

Use IIS Crypto to enable the proper cipher suites https://www.nartac.com/Products/IISCrypto

It looks like these cipher suites are supported https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-8-1

But require this update: https://support.microsoft.com/en-us/topic/windows-rt-8-1-windows-8-1-and-windows-server-2012-r2-update-april-2014-3c9d820b-7079-359d-8660-21de648fa31d

3
  • The update KB2919355 is installed in the server. According to some documents in internet I should find the installed ciphers in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL but it is almost empty. I will check the software you suggested.
    – Filippo
    Feb 13 at 7:56
  • Set best practices values with IIS Crypto, nothing changed.
    – Filippo
    Feb 13 at 14:00
  • Did you also do a reboot?
    – Turdie
    Feb 14 at 16:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .