• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 389
  • Last Modified:

Is 256bit SSL backwards compatiable with legacy 128bit?

Hi,

I want to enable 256bit encryption which my SSL certificate is capable of for Windows 2008 R2 server. With IIS7 to do 256 bit encryption, we have to ensure the cipher suit that is listed first is the following: TLS_RSA_WITH_AES_256_CBC_SHA, if I do this will old browsers / systems still be able to connect with legacy 128bit?

I don't want to stop people who can only achieve 128bit from connecting and using the website. How can I ensure that the site is 256bit and 128bit compatible?
0
Jeremy Leys
Asked:
Jeremy Leys
  • 2
1 Solution
 
Dave HoweSoftware and Hardware EngineerCommented:
I am not sure you can prefer 256 bit without disabling 128.

Out of the box, servers usually honour the order the client sends its SSL cypher suites in.

For apache, you can override that with the SSLHonorCipherOrder directive (which causes Apache to use its own list order to determine the "best" match) but I am not aware of any matching directive for IIS7 - so if you have TLS_RSA_WITH_AES_256_CBC_SHA listed first, it will be supported, but if a client sends a 128 bit cypher first in its SSL cyphersuites list, that will be selected (if supported) even if 256 bit AES is available further down the list.

The following may be useful for your testing:
https://www.nartac.com/Products/IISCrypto/Default.aspx

it is a gui tool to adjust the suite order in the registry :)
0
 
Jeremy LeysTechnical LeadAuthor Commented:
Thank you, the documentation you provided is excellent, yes you are right as far as I can see from my testing you can't prefer 256 bit without disabling 128. But thanks anyway I am going to stick to 128bit for the time being.
0
 
Dave HoweSoftware and Hardware EngineerCommented:
sorry I couldn't give you a better answer, but IIS is not particularly configurable in this matter :(
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now