Is 256bit SSL backwards compatiable with legacy 128bit?

Hi,

I want to enable 256bit encryption which my SSL certificate is capable of for Windows 2008 R2 server. With IIS7 to do 256 bit encryption, we have to ensure the cipher suit that is listed first is the following: TLS_RSA_WITH_AES_256_CBC_SHA, if I do this will old browsers / systems still be able to connect with legacy 128bit?

I don't want to stop people who can only achieve 128bit from connecting and using the website. How can I ensure that the site is 256bit and 128bit compatible?
Jeremy LeysTechnical LeadAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dave HoweSoftware and Hardware EngineerCommented:
I am not sure you can prefer 256 bit without disabling 128.

Out of the box, servers usually honour the order the client sends its SSL cypher suites in.

For apache, you can override that with the SSLHonorCipherOrder directive (which causes Apache to use its own list order to determine the "best" match) but I am not aware of any matching directive for IIS7 - so if you have TLS_RSA_WITH_AES_256_CBC_SHA listed first, it will be supported, but if a client sends a 128 bit cypher first in its SSL cyphersuites list, that will be selected (if supported) even if 256 bit AES is available further down the list.

The following may be useful for your testing:
https://www.nartac.com/Products/IISCrypto/Default.aspx

it is a gui tool to adjust the suite order in the registry :)
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jeremy LeysTechnical LeadAuthor Commented:
Thank you, the documentation you provided is excellent, yes you are right as far as I can see from my testing you can't prefer 256 bit without disabling 128. But thanks anyway I am going to stick to 128bit for the time being.
0
Dave HoweSoftware and Hardware EngineerCommented:
sorry I couldn't give you a better answer, but IIS is not particularly configurable in this matter :(
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Security

From novice to tech pro — start learning today.