asked on

IIS 7 - disable SSL 2.0

I have followed the article at http://support.microsoft.com/kb/187498 and restarted my server after making the changes.

However after doing a TCP dump, I still see SSL 2.0 being negotiated.

I am running IIS 7 and Windows Server 2008.

How can I disable SSL 2.0 permanently?

My TCPDump says this:

Secure Socket Layer
SSLv2 Record Layer: Client Hello
[Version: SSL 2.0 (0x0002)]
Length: 98
Handshake message Type: Client Hello (1)
Version: TLS 1.0 (0x0301)
Cipher Spec Length: 57
Session ID Length: 0
Challenge length: 32

ASKER CERTIFIED SOLUTION

Shreedhar Ette

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

symigeek

ASKER

Yes, that is exactly what I did, including rebooting my server after the registry change.

garrett_boarder

I ran this from the command line and then rebooted my server. (REG ADD "HKLM\System\CurrentControlSet\Control\SecurityProviders\SChannel\Protocols\SSL 2.0\Server" /v DisabledByDefault /t REG_DWORD /d 1 /f) All was well after that. Needed this for PCI Compliance. You can go to http://serversniff.net/content.php?do=ssl to test your ssl status or you can force IE to use SSL 2 as well to test by going to Tools --> Internet Options --> Scroll Towards the bottom and uncheck SSL 3 as well as TLS 1 and check SSL 2. You will need to close the browser and open it up again and you should get a page can not be displayed error. Make sure to re-enable SSL 3 and TLS 1.0 afterwards. Also I had to do a false positive report to the pci scanning company since they were still flagging SSL 2.

garrett_boarder

You need to use the Advanced tab on Internet Options to find the SSL settings. Forgot to mention that.

garrett_boarder

http://www.sslshopper.com/article-how-to-disable-ssl-2.0-in-iis-7.html This method worked for me in IIS 6 since it seems to like Enabled = 0 reg key instead of DisabledByDefault = 1.

symigeek

ASKER

Even though I had already done this, it turned out to the the solution.