I'm testing this on a fresh 2012 R2 server, when applying the Alexander Hass script (AH-Script), I still get the obsolete cryptography:
My Chrome 43 supports the following Cipher suites:
so the one used is: [C013], quite far down. It seems Chrome prefers SHA256 and GCM over CBC.
I took the AH-Script and added [009E] (3rd from the top) to the cipher suite list, after rebooting I'm now getting:
I tried to get the top two [C08B] and [C02F] to work, but couldn't.
So by fixing the script and running it I got a
I removed one of the existing ciphers because the length of that string is limited, the beginning of my string now looks like this:
$cipherSuitesOrder = @(
Edit: I just tested this on sslLabs.com and using
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 gives me a
B, down from an
A I had before.
This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B.
So you may not want to use it. Why Chrome rates it so high, I don't know?