RE: IIS - use SSL 3.0 only

Hi Mark,


Thanks for posting here.

From the description, I understand the issue is that you want to only use
SSL 3.0 for IIS 6.0 If I am off base, please don't hesitate to let me know.

By default, IIS supports a batch of protocols, inc: TLS 1.0, PCT 1.0, SSL
2.0 and SSL 3.0. The protocol selection is controlled by clients-side. IE
supports SSL2.0, SSL3.0 and TLS 1.0 (The configuration is in Internet
Options->Advanced). For some special application, we can disable some
protocol support on either server-side or client-side:

187498 Disable PCT 1.0, SSL 2.0, or SSL 3.0 on IIS
http://support.microsoft.com/?id=187498

http://www.winnetmag.com/Windows/Article/ArticleID/7741/7741.html

NOTE: This response contains a reference to a third party World Wide Web
site. Microsoft is providing this information as a convenience to you.
Microsoft does not control these sites and has not tested any software or
information found on these sites; therefore, Microsoft cannot make any
representations regarding the quality, safety, or suitability of any
software or information found there. There are inherent dangers in the use
of any software found on the Internet, and Microsoft cautions you to make
sure that you completely understand the risk before retrieving any software
from the Internet.


the client and the server negotiate a common protocol to help secure the
channel. If the server and the client have multiple protocols in common,
IIS tries to help secure the channel with one of the protocols that IIS
supports. The protocol that IIS uses is selected in the following order of
preference:

1. PCT 1.0
2. SSL 3.0
3. SSL 2.0
Sometimes, you may want to disable one or more of these protocols. You can
do this if you change the registry.

So you can disable PCT 1.0 and SSL 2.0 by change the registry on the server
in the IE configuration on the client,just select SSL 3.0


Hope this helps

Have a nice day!

Best regards,

Jacky Luo (MSFT)
Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
====================================================
PLEASE NOTE: The partner managed newsgroups are provided to
assist with break/fix issues and simple how to questions.
We also love to hear your product feedback! Let us know what you think by
posting

from the web interface: Partner Feedback
from your newsreader: microsoft.private.directaccess.partnerfeedback.

We look forward to hearing from you!
====================================================
When responding to posts, please "Reply to Group" via your newsreader
so that others may learn and benefit from this issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
====================================================

.

Relevant Pages

  • Re: Disabling SSL version 2 protocol and 40-bit and 56 bit ciphers
    ... > I recently had a security audit on one of my web sites running IIS 5. ... issues were highlighted surrounding SSL: ... supported protocols. ...
    (microsoft.public.inetserver.iis.security)
  • Webcast: SSL Concepts and Troubleshooting August 8th Friday
    ... learn about Secure Socket Layers and IIS. ... SSL at Microsoft Corp.: ... SSL: Common Troubleshooting Problems ...
    (microsoft.public.inetserver.iis.security)
  • Re: SSL broken after Windows 2003 upgrade
    ... The svchost.exe you reference is "IIS". ... routes them to the appropriate w3wp.exe based on configuration from WAS ... WFetch can make both a normal SSL request as well as a Client-Certificate ...
    (microsoft.public.inetserver.iis)
  • Re: Win2003 Upgrade Broke SSL?
    ... The reason I say that the upgrade did not break SSL is because IIS has no ... problems relating to port 443 being occupied suggests that you did something ...
    (microsoft.public.inetserver.iis)
  • Re: WCF webservice over SSL and without
    ... Based on your further description, you have setup the SSL correctly in IIS server, but encountered some problem visit the WCF service's metadata page, correct? ... \par> Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.webservices)