1

I've configured IIS on Windows Server 2008 R2 to not allow TLS 1.0. I've done this by setting these reg keys and rebooting:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server\DisabledByDefault set to 1 (as a DWORD)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server\Enabled set to 0 (as a DWORD)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\DisabledByDefault set to 1 (as a DWORD)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\Enabled set to 0 (as a DWORD)

On the client side, I'm using FireFox 48.0 and IE 9 to test. (I can't use later versions of IE because the network admins have the settings locked down). This is how I'm configuring IE to force TLS 1.0:

Tools-Internet Options-Advanced

This is how I'm configuring FireFox to force TLS 1.0:

enter image description here

I'm using WireShark to confirm the protocol being used. This is what it looks like when I force TLS 1.0 in the browser: enter image description here

I've also used the OpenSSL command suggested below to confirm that TLS 1.0 is still being used:

openssl s_client -tls1 -connect mysite.com:443

If I force TLS 1.1 in the browser, this is what WireShark look like: enter image description here

The problem is that the server is configured to not allow TLS 1.0, but when I configure my browser to only use TLS 1.0, then TLS 1.0 is being used. If I configure IE to not allow any version of TLS, then it returns an error "Internet Explorer cannot display the web page" which is what I would expect. My goal is to prevent the server from using TLS 1.0 even if the client only supports TLS 1.0 because TLS 1.0 has security vulnerabilities. How can I get IIS to stop using TLS 1.0?

  • Your subject line doesn't really accurately reflect the question you're asking. You have already confirmed that TLS v1.0 still works. (and i don't know the answer to the question you're trying to ask, only the one stated in the subject :) – Dan Pritts Aug 8 '16 at 15:58
  • The steps you've taken, setting browsers to use TLS 1.0 and sniffing the traffic, are exactly how you would confirm that TLS 1.0 is disabled in IIS. Unfortunately, your testing has shown that it's not disabled - so I presumed that the question you were trying to ask was "how do i disable it". I missed the sentence that said you weren't sure that wireshark was telling you the right thing. – Dan Pritts Aug 8 '16 at 18:06
  • I could have been clearer about the question. Now that I know that I'm correctly confirming TLS 1.0 is still enabled, do I post a new question or modify this one? Should I delete these comments that have more to do with properly using the site? Thanks. – Dwayne Driskill Aug 8 '16 at 18:21
  • I'd just edit the question to add the relevant information - probably at the top. removing the comments isn't necessary I don't think. – Dan Pritts Aug 8 '16 at 18:32
  • You may want to include the output of the following command instead of what you have provided: reg export "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" C:\TEMP\TLS.txt – Greg Askew Aug 10 '16 at 16:01
3

You can verify if server will serve TLS 1.0 if requested with the following openssl command.

openssl s_client -tls1  -brief -connect example.com:443

If connection has succeed you will see something like:

CONNECTION ESTABLISHED
Protocol version: TLSv1
Ciphersuite: DHE-RSA-AES256-SHA
Peer certificate: CN = example.com
Server Temp Key: DH, 8192 bits

If connection has failed you will see:

write:errno=104

You can test support for other protocols by issuing:

TLS v1.1: openssl s_client -tls1_1 -brief -connect example.com:443

TLS v1.2: openssl s_client -tls1_2 -brief -connect example.com:443

SSL v3: openssl s_client -ssl3 -brief -connect example.com:443

1

I know this is old, but this may help someone else. If FIPS is enabled it will override the TLS 1.0 settings and enable TLS 1.0. It has to be disabled to disable TLS 1.0. Hope this helps someone.

0

The problem was that SSL was actually being handled by a load balancer and not on the server so it had to be disabled on the load balancer.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.