I've configured IIS on Windows Server 2008 R2 to not allow TLS 1.0. I've done this by setting these reg keys and rebooting:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server\DisabledByDefault set to 1 (as a DWORD) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server\Enabled set to 0 (as a DWORD) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\DisabledByDefault set to 1 (as a DWORD) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client\Enabled set to 0 (as a DWORD)
On the client side, I'm using FireFox 48.0 and IE 9 to test. (I can't use later versions of IE because the network admins have the settings locked down). This is how I'm configuring IE to force TLS 1.0:
This is how I'm configuring FireFox to force TLS 1.0:
I've also used the OpenSSL command suggested below to confirm that TLS 1.0 is still being used:
openssl s_client -tls1 -connect mysite.com:443
The problem is that the server is configured to not allow TLS 1.0, but when I configure my browser to only use TLS 1.0, then TLS 1.0 is being used. If I configure IE to not allow any version of TLS, then it returns an error "
Internet Explorer cannot display the web page" which is what I would expect. My goal is to prevent the server from using TLS 1.0 even if the client only supports TLS 1.0 because TLS 1.0 has security vulnerabilities.
How can I get IIS to stop using TLS 1.0?