Solved

Is 256bit SSL backwards compatiable with legacy 128bit?

Posted on 2014-02-25
3
369 Views
Last Modified: 2014-03-03
Hi,

I want to enable 256bit encryption which my SSL certificate is capable of for Windows 2008 R2 server. With IIS7 to do 256 bit encryption, we have to ensure the cipher suit that is listed first is the following: TLS_RSA_WITH_AES_256_CBC_SHA, if I do this will old browsers / systems still be able to connect with legacy 128bit?

I don't want to stop people who can only achieve 128bit from connecting and using the website. How can I ensure that the site is 256bit and 128bit compatible?
0
Comment
Question by:jwleys
  • 2
3 Comments
 
LVL 33

Accepted Solution

by:
Dave Howe earned 500 total points
ID: 39887815
I am not sure you can prefer 256 bit without disabling 128.

Out of the box, servers usually honour the order the client sends its SSL cypher suites in.

For apache, you can override that with the SSLHonorCipherOrder directive (which causes Apache to use its own list order to determine the "best" match) but I am not aware of any matching directive for IIS7 - so if you have TLS_RSA_WITH_AES_256_CBC_SHA listed first, it will be supported, but if a client sends a 128 bit cypher first in its SSL cyphersuites list, that will be selected (if supported) even if 256 bit AES is available further down the list.

The following may be useful for your testing:
https://www.nartac.com/Products/IISCrypto/Default.aspx

it is a gui tool to adjust the suite order in the registry :)
0
 

Author Closing Comment

by:jwleys
ID: 39901298
Thank you, the documentation you provided is excellent, yes you are right as far as I can see from my testing you can't prefer 256 bit without disabling 128. But thanks anyway I am going to stick to 128bit for the time being.
0
 
LVL 33

Expert Comment

by:Dave Howe
ID: 39901438
sorry I couldn't give you a better answer, but IIS is not particularly configurable in this matter :(
0

Featured Post

New My Cloud Pro Series - organize everything!

With space to keep virtually everything, the My Cloud Pro Series offers your team the network storage to edit, save and share production files from anywhere with an internet connection. Compatible with both Mac and PC, you're able to protect your content regardless of OS.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Article by: btan
Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
Encryption for Business Encryption (https://en.wikipedia.org/wiki/Encryption) ensures the safety of our data when sending emails. In most cases, to read an encrypted email you must enter a secret key that will enable you to decrypt the email. T…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

948 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now