how to disable sslv3 for all my computers

Posted on 2014-11-03
Last Modified: 2014-11-11
how to disable sslv3 for all my computers, do anyone have any ideas?
Question by:NxJNY
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
  • +1
LVL 14

Assisted Solution

John-Charles-Herzberg earned 150 total points
ID: 40419448
If you need to Disabling POODLE  SSLv3 Support in Browsers this is how you do it.

Expert Comment

ID: 40419469
SSLv3 need to be disabled on the server side only

Author Comment

ID: 40419536
Thanks Guys

@ John-Charles-Herzberg - i was hoping for a solution to disable all PC's via script or some other tool rather than doing one PC at a time.

@ Stampel - are you sure if we disable only server side it will not affect the local PC's
How our DevOps Teams Maximize Uptime

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us. Read the use case whitepaper.


Expert Comment

ID: 40419745
Nop It won't, SSL will fallback to SSLv2 (assuming you had SSLv2 Cypher on server side, but who would not ? And you will review this when configuring server.)
LVL 70

Accepted Solution

Qlemo earned 350 total points
ID: 40431106
At least for IE you can run the MS FixIt or a Group Policy, as described in the MS Security Advisory at . The FixIt can be called with MSI options, I recommend /passive to not get any prompts.

As and other sources tell, you need to change the startup options for Chrome - no setting there. The best automated approach here is the described change of the registry, which can be done with a batch. The batch only acts if Chrome is the default browser.
@echo off
setlocal EnableDelayedExpansion
for /F "tokens=2*" %A in ('reg query HKCR\http\shell\open\command ^| find "Chrome" ') do (
  set val=%%B
  set val=!val:"=""""!
  reg add HKCR\http\shell\open\command /f /ve /t Reg_SZ /d "!val:-- =--ssl-version-min=tls1 -- !"

Open in new window

But: Chrome and FireFox will receive updates (if not already done) to disable SSLv3 by default.
And to use an exploit, an attacker needs local, direct access to the victim, and so needs to be in (W)LAN etc.
And of course you need to make sure that the client does not allow SSLv3 to be certain it is not used. You do not have control over all servers, and contacting any unpatched server opens the client up to the attack (if all the other requirements are met, of course). It is not safe to rely on proper server settings.
LVL 70

Expert Comment

ID: 40435999
Any reason for "B" grade? I'm pretty certain my anser was worth more than that.

Author Comment

ID: 40436006
sorry the B grade was a mistake i meant A - any idea how to change it?

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolve DNS query failed errors for Exchange
I've been an avid user and supporter of Malwarebytes Premium Version 2.x for years. It's an excellent product that runs alongside just about any Anti-Virus application without issues. It seems to have an uncanny ability to pick up many things that A…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor ( Top Charts is a view in which you can set seve…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question