Is 256bit SSL backwards compatiable with legacy 128bit?

Hi,

I want to enable 256bit encryption which my SSL certificate is capable of for Windows 2008 R2 server. With IIS7 to do 256 bit encryption, we have to ensure the cipher suit that is listed first is the following: TLS_RSA_WITH_AES_256_CBC_SHA, if I do this will old browsers / systems still be able to connect with legacy 128bit?

I don't want to stop people who can only achieve 128bit from connecting and using the website. How can I ensure that the site is 256bit and 128bit compatible?
Jeremy LeysTechnical LeadAsked:
Who is Participating?
 
Dave HoweSoftware and Hardware EngineerCommented:
I am not sure you can prefer 256 bit without disabling 128.

Out of the box, servers usually honour the order the client sends its SSL cypher suites in.

For apache, you can override that with the SSLHonorCipherOrder directive (which causes Apache to use its own list order to determine the "best" match) but I am not aware of any matching directive for IIS7 - so if you have TLS_RSA_WITH_AES_256_CBC_SHA listed first, it will be supported, but if a client sends a 128 bit cypher first in its SSL cyphersuites list, that will be selected (if supported) even if 256 bit AES is available further down the list.

The following may be useful for your testing:
https://www.nartac.com/Products/IISCrypto/Default.aspx

it is a gui tool to adjust the suite order in the registry :)
0
 
Jeremy LeysTechnical LeadAuthor Commented:
Thank you, the documentation you provided is excellent, yes you are right as far as I can see from my testing you can't prefer 256 bit without disabling 128. But thanks anyway I am going to stick to 128bit for the time being.
0
 
Dave HoweSoftware and Hardware EngineerCommented:
sorry I couldn't give you a better answer, but IIS is not particularly configurable in this matter :(
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.