Comments on: Windows / IIS SSL – Restrict Weak Ciphers

By: Removing weak ciphers / protocols from Windows Server 2003 IIS 6 « Jonathan McLeod Blog

Tue, 25 May 2010 18:20:21 +0000

[...] http://www.curtis-lamasters.com/2008/06/21/windows-iis-ssl-restrict-weak-ciphers/ [...]

By: Steve

Steve — Thu, 21 May 2009 19:31:48 +0000

Hello
In reply to John

It does scan any and all servers behind the public ip… Assuming that this is a netscaler / load balancer for multiple web servers. The Virtual IP assigned represents all of the backend physical ips associated to the individual web sites. Best bet is to determine the physical ips associated to the Virtual IP that is throwing a positive from the scan. When that is done you’ll need to find the actual servers that these reside on. Apply these patches as directed above to those servers. Make sure you capture / back up the existing entries in the registry as I have seen this cause client issues with non IE browsers.

Good Luck!

Steve

By: John

John — Mon, 27 Apr 2009 23:56:12 +0000

Hello,

I am having the same problems with these ciphers and security metrics. I have disabled everything lower than 128 and I am still not passing the scan. Does anyone know if security metrics scans every server and workstation behind our Public IP or is it just the server that is port forwarded? I have been working on this for almost a month now and the security metrics tech support is of no help at ALL (what a joke), they do not even know what their tests scans!! Any help would be greatly appreciated.

Thanks!

By: clamasters

clamasters — Mon, 30 Mar 2009 17:00:05 +0000

Your mileage may vary. I have run this on 30 plus servers with zero issues but usually depending on the OS/Browser version of the client viewing the site/application, you may experience issues.

By: Yong

Yong — Mon, 30 Mar 2009 16:16:32 +0000

Any of this alteration affect your application?

By: Marty

Marty — Fri, 27 Feb 2009 01:35:20 +0000

Mahalo Nui Loa (Thank you very much in Hawaiian)

Your solution worked great!!! Really appreciate you publishing it.

By: Calazan

Calazan — Wed, 28 Jan 2009 00:53:37 +0000

Thanks! We passed the SecurityMetrics PCI scan by following your instructions.

Pav, for us we disabled the following:
DES 56/56
RC2 40/128
RC4 40/128
RC4 56/128.

And like the others said, SSL 2.0 support should also be disabled.

By: » IIS Security Scan: The remote service supports the use of weak SSL ciphers Calazan.com: Share the Knowledge

Wed, 28 Jan 2009 00:42:19 +0000

[...] goes to this website for this solution: http://www.curtis-lamasters.com/2008/06/21/windows-iis-ssl-restrict-weak-ciphers/ addthis_url = [...]

By: Rick

Rick — Thu, 22 Jan 2009 22:29:06 +0000

Everyone’s one a PCI compliance kick…this: http://support.microsoft.com/kb/245030/en-us
tells how to only support SSL 3.0 or TLS 1.0 and not SSL 2.0

in a nutshell:
regedit to HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
then set the below to dword “Enabled”, value 0×0

\PCT 1.0\Client
\PCT 1.0\Server
\SSL 2.0\Client
\SSL 2.0\Server

By: Pav

Pav — Tue, 20 Jan 2009 14:37:36 +0000

James, Joey – did it sort out Security Metrics for you. I’m still having problems with the ciphers. Let me know if you got it right.