17

Anyone know how to disable certain SSL versions and only enable others in IIS 7.5?

Improve this question
4
  • Disabling SSL 2.0 sounds like a really bad idea; are you sure you want to do this?
    – blueberryfields
    Jan 5, 2010 at 7:18
  • 6
    @blueberryfields: SSLv2 is ancient, current version is TLSv1.1 (TLSv1=SSLv3), and has known security holes
    – LapTop006
    Jan 5, 2010 at 11:58
  • 14
    Disabling SSL 2.0 is a very good idea (and required to pass a PCI compliance test).
    – Robert
    Jan 5, 2010 at 15:01
  • If you need the updated KB from MS, try this support.microsoft.com/en-us/kb/245030 It's the one that IIS Crypto uses...
    – Carlos Garcia
    Dec 14, 2015 at 16:49

3 Answers 3

Reset to default
24
  1. Open regedit

  2. Navigate to, or create the keys as necessary:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server

  3. Create/Edit the value Enabled, type DWORD, value "0"

  4. Reboot

Notes: The same proceedure applied to key names PCT 1.0, SSL 2.0, SSL 3.0, TLS 1.0. In newer versions of Windows some of these are disabled by default - which depends on what version.

Reference: http://support.microsoft.com/kb/187498

Improve this answer
0
8

This is something you need to fix in regedit,

regedit can be opened with "start", "run", regedit

once there, find this entry:

HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0

Right-click on the SSL 2.0 folder and select New and then click Key. Name the new folder Server.

Inside the Server folder, click the Edit menu, select New, and click DWORD (32-bit) Value.

Enter Enabled as the name and hit Enter.

Ensure that it shows 0x00000000 (0) under the Data column (it should by default). If it doesn't, right-click and select Modify and enter 0 as the Value data.

Restart the computer.

a nice explanation can be found here, including how to disable other weak ciphers

https://www.sslshopper.com/article-how-to-disable-ssl-2.0-in-iis-7.html

Improve this answer
1
  • and now, I guess we have to start disabling SSLv3.0 also
    – Sverre
    Oct 17, 2014 at 3:38
6

If you are not comfortable manually editing the registry, you can either use a power shell script or a GUI program to do all this for you.

There is a great script by Alexnder Hass here - Setup your IIS for SSL Perfect Forward Secrecy and TLS 1.2

I personally like to use IIS Crypto it is so easy and lets you order and choose crypto suites, ciphers etc. You can just use the 'best practices' if you are not sure what you are doing.

enter image description here

Also, once you are done rebooting the server, head over to SSL Labs to test your server.

Good Luck!

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.