2

I have tried to disable SSL3.0 on my Windows web server that is running Windows Server 2008R2 with IIS 7.5. I have entered the following registry keys:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
"DisabledByDefault"=dword:00000001

After rebooting the server I have checked my site's SSL protocols using nmap and openssl.

NMAP Command:

nmap --script ssl-enum-ciphers mysite.com

NMAP Output:

| ssl-enum-ciphers: 
|   SSLv3: 
|     ciphers: 
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_RSA_WITH_RC4_128_MD5 - strong
|       TLS_RSA_WITH_RC4_128_SHA - strong
|     compressors: 
|       NULL
|   TLSv1.0: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_RC4_128_MD5 - strong
|       TLS_RSA_WITH_RC4_128_SHA - strong
|     compressors: 
|       NULL
|_  least strength: strong

OpenSSL Command:

openssl s_client -connect mysite.com:443 -ssl3

OpenSSL Output:

SSL handshake has read 2540 bytes and written 486 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : RC4-SHA
    Session-ID: (omitted...)
    Session-ID-ctx: 
    Master-Key: (omitted...)
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1415005218
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)

Could anyone please help me disable SSL3 on the server ?

Thanks in advance

  • You must restart your computer for the changes to take effect. – Michael Hampton Nov 3 '14 at 16:45
2

I used IIS Crypto to do this, seems to work just fine. Note that a full reboot is required after disabling/enabling encryption methods.

  • I will try this now and schedule a reboot for out of hours. If it works I will mark this as the answer tomorrow. – Seany84 Nov 3 '14 at 9:47
  • Can you please tell me what I need to disable using IIS Crypto? The SSL 3.0 is unchecked when I ran the tool. I presume I need to disable some of the SSL Ciphers? Can you tell me which ones please? – Seany84 Nov 3 '14 at 9:55
  • 1
    @Seany84 If SSL 3.0 already is unchecked then your registry changes worked - you probably didn't reboot? You could also do what I did and just select FIPS compliance to make sure that the cipher suites are correct etc.. – pauska Nov 3 '14 at 9:58
  • I just checked the result of the scheduled task and it appears as though the reboot did not happen. I've fixed the scheduled task and will know tomorrow. Thanks – Seany84 Nov 3 '14 at 10:10
  • I can confirm that the registry setting disabled ssl3 only after the reboot. Thanks – Seany84 Nov 5 '14 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.