Anyone know how to disable certain SSL versions and only enable others in IIS 7.5?
Disabling SSL 2.0 sounds like a really bad idea; are you sure you want to do this?– blueberryfieldsJan 5, 2010 at 7:18
6@blueberryfields: SSLv2 is ancient, current version is TLSv1.1 (TLSv1=SSLv3), and has known security holes– LapTop006Jan 5, 2010 at 11:58
14Disabling SSL 2.0 is a very good idea (and required to pass a PCI compliance test).– RobertJan 5, 2010 at 15:01
If you need the updated KB from MS, try this support.microsoft.com/en-us/kb/245030 It's the one that IIS Crypto uses...– Carlos GarciaDec 14, 2015 at 16:49
Navigate to, or create the keys as necessary:
Create/Edit the value
Enabled, type DWORD, value "0"
Notes: The same proceedure applied to key names
TLS 1.0. In newer versions of Windows some of these are disabled by default - which depends on what version.
This is something you need to fix in regedit,
regedit can be opened with "start", "run",
once there, find this entry:
Right-click on the SSL 2.0 folder and select New and then click Key. Name the new folder Server.
Inside the Server folder, click the Edit menu, select New, and click DWORD (32-bit) Value.
Enter Enabled as the name and hit Enter.
Ensure that it shows
0x00000000 (0) under the Data column (it should by default). If it doesn't, right-click and select Modify and enter 0 as the Value data.
Restart the computer.
a nice explanation can be found here, including how to disable other weak ciphers
If you are not comfortable manually editing the registry, you can either use a power shell script or a GUI program to do all this for you.
There is a great script by Alexnder Hass here - Setup your IIS for SSL Perfect Forward Secrecy and TLS 1.2
I personally like to use IIS Crypto it is so easy and lets you order and choose crypto suites, ciphers etc. You can just use the 'best practices' if you are not sure what you are doing.
Also, once you are done rebooting the server, head over to SSL Labs to test your server.