Trying to get a windows 2008 R2 server to the latest PCI standards, which require disabling of TLS 1.0

FTPS stops working once TLS 1.0 is disabled. TLS 1.1 and 1.2 are enabled and all other SSL items (RDP and websites) are working using TLS 1.1 or 1.2 correctly.

Our clients use Core FTP to FTPS to the server (since this appears to be the only FTP software that worked stably with FTPS)

234 AUTH command ok. Expecting TLS Negotiation. TLSv1, cipher TLSv1/SSLv3 (RC4-MD5) - 128 bit

is Core FTP connecting to our server with TLS 1.0 enabled. Once disabled and server rebooted, a connection cannot be established to the server at all.

There doesn't appear to be anywhere in CoreFTP or IIS 7.5 to set which versions of TLS to use. All settings for PCI have been changing using the crypto tool to ensure they are correct.

Any suggestions, or is this another issue with Microsoft products simply not working without TLS 1.0 or SSLv3?

bumped to the homepage by Community 17 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • "Once disabled and server rebooted, a connection cannot be established to the server at all" and what about other ftp clients? You could check with openssl if you have any linux server 'openssl s_client -connect ftps.example.net:21 -starttls ftp' – ALex_hha Feb 29 '16 at 11:46

Coreftp does not support anything higher than TLS 1.0. I suggest you use smartftp, which supports up to TLS 1.2.

  • At least core ftp 2.2 works fine with tlsv1.2 – ALex_hha Feb 29 '16 at 11:44

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.