Failing SSL report at SSL Labs

Hi,

We’re getting an F: grade for our Webmail URL on  https://www.ssllabs.com/ssltest/analyze.html the reason being:

##############
This server is vulnerable to MITM attacks because it supports insecure renegotiation. Grade set to F:
##############

The URL that’s failing is a link for OWA that’s goes our Firewall > TMG > Exchange 2010.  TMG and Exchange are both 2008 r2 SP1 x64 and fully MS patched.  I’ve done a bit of reading and found a tool that apparently should fix called "IIS Crypto"

https://www.nartac.com/Products/IISCrypto/

I’ve run on the TMG server and rebooted but it’s still failing. ):

What exactly should we be doing to fix this and on which server (e.g. TMG or Exchange)?


Cheers
kswan_expertAsked:
Who is Participating?
 
btanConnect With a Mentor Exec ConsultantCommented:
rightfully if the requests is to be consumed by the exchange server, TMG should be not part of the assessment. You may want to check if TMG on supporting secure ssl renegotiation
http://www.carbonwind.net/blog/post/Forefront-TMG-2010-now-supports-the-secure-TLS-renegotiation-extension.aspx

Good to take note of this as well
http://social.technet.microsoft.com/Forums/forefront/en-US/dae29c85-0714-48fb-873e-0e93936ff67d/tmg-vulnerable-to-beast-attack-qualys-ssl-lab-test?forum=Forefrontedgegeneral

Overall, I suggest you also check this EE - the MITM is covered under addressing item (2). Extracted one of the patches to address the vulnerabilities. See in the MS bulletion on "TLS/SSL Renegotiation Vulnerability - CVE-2009-3555"

http://www.experts-exchange.com/Security/Vulnerabilities/Q_28282855.html

b) CVE-2009-3555 which is SSL/TLS renegotiation vulnerability
http://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-2009-3555
> Microsoft release security bulletin which you can drill into  Vulnerability Information (based on the CVE) and the affected version. The Microsoft Baseline Security Analyzer should be able to check if this bulletin is installed in the machine

@ http://technet.microsoft.com/en-us/security/bulletin/MS10-049
0
 
kswan_expertAuthor Commented:
Thanks, will have a look at the Exchanger server.  I'm a bit wary of running IIS crypto on our Prod Exchange VM so will see if i can find the reg changes to add manually. The URL mentioned in your link above for MITM is dead. ):
0
 
btanExec ConsultantCommented:
Sure keep us posted. Rather not introduce another lockdown tool unnecessarily
0
 
kswan_expertAuthor Commented:
Fixed!!

If interested -

On TMG server under ---  HKLM\System\CurrentControlSet\Control\SecurityProviders\SChannel\

added

DisableRenegoOnServer      1
AllowInsecureRenegoClients       0


See article but needed to add
http://www.isaserver.org/articles-tutorials/configuration-security/improving-ssl-security-forefront-threat-management-gateway-tmg-2010-published-web-sites.html


Thanks breadtan
0
 
btanExec ConsultantCommented:
thanks for sharing!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.