(If you're wondering why I'm trying to enable cipher suites that are deprecated, the short answer is that it's for the few people who really can't use anything newer because they're stuck on Windows Server 2003, neither we nor them can do anything about it and we don't want the service we supply them with to stop working if we can help it.)
I have used IIS Crypto to enable a number of protocols, ciphers, hashes, key exchanges and cipher suites (here is a full listing) that should encompass what's necessary for our product to connect to this server over TLS 1.0 considering Schannel's capabilities in Windows Server 2003. (The server has been rebooted since the changes were applied in IIS Crypto.)
However, the server drops the connection and documents it with the following two event log entries, posted by Schannel in the System event log:
"An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed." - event ID 36874
"A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 40. The Windows SChannel error state is 1205." - event ID 36888
Using Wireshark on the client, I can see that it is trying to negotiate the following cipher suites:
Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_RSA_WITH_DES_CBC_SHA (0x0009) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (0x0064) Cipher Suite: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA (0x0062) Cipher Suite: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003) Cipher Suite: TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x0006) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_DHE_DSS_WITH_DES_CBC_SHA (0x0012) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA (0x0063)
of which these:
TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_3DES_EDE_CBC_SHA
are included in what I enabled with IIS Crypto. Yet still the server doesn't want to touch these cipher suites and allow a connection to be made. It just drops the connection instead, as evidenced by this attempt to connect using OpenSSL.
Why is IIS or Schannel not allowing the use of these cipher suites when, as far as I can tell, I have configured them both to use them regardless of the defaults?