I am receiving errors in the event log with ID numbers 36888 and 36874. The errors state "The following fatal alert was generated: 40. The internal error state is 1205." and "An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed" respectively. I would like to find what is causing this without disabling schannel logging. The OS is running Windows Server 2008 R2 and Outlook Web Access. IE settings on the server have TLS 1.0, TLS 1.1, TLS 1.2, SSL 3.0 checked off while SSL 2.0 is unchecked. How should I go about investigating this issue? Capture with wireshark and go from there or something else entirely?
Such an occurrence can always be forced from the outside; it suffices to connect and send a
ClientHello message that lists only junk values as "supported cipher suites". Using Wireshark or some equivalent monitoring tool like Microsoft's Network Monitor is indeed the way to go:
- Activate HTTP-level logging on IIS.
- Fire up the monitor tool.
- Wait for the event to appear again.
- See the received
ClientHellomessages at the time the event was triggered.
ClientHello messages are, by necessity, not encrypted. Thus, you can see the list of announced cipher suites, and match that against your server configuration. The network monitor tool will also show you the client IP address. If the message is part of a multi-connection attempt (e.g. client first tries to connect with some parameters, then tries again with some others) then you may see a successful connection from the same client, at which point the HTTP-level logging in IIS will tell you what software the client claims to use (this is part of the HTTP headers).
A plausible explanation is probing: if someone wants to work out what cipher suites your server supports, then it will do some connection attempts with a dwindling list of supported cipher suites; this must ultimately end up with an event like the one you show. Probing tools which do that are available as an online service; others can be downloaded.
Any Internet-facing server can expect to be probed occasionally; such is the state of things (morally deplorable, but unlikely to change in the near future). Your best bet may be to simply filter out these events from your alerting mechanism, so as to ignore them completely. They are mostly harmless anyway.