Link to home
Start Free TrialLog in
Avatar of zito2000
zito2000Flag for United States of America

asked on

Certain IIS Pages unable to be displayed in IE11, or Microsoft Edge

Users cannot get to specific web pages (on IIS) using internet explorer 11, or microsoft edge.

The error message they recieve is attached to this question. Basically, IE is telling us to turn on TLS 1.0, TLS 1,1 and TLS 1.2

The Pages work fine in Chrome (I havent tested any additional browser),  

Is There a way to see which protocols are being used in IIS and how we can modify them if necessary?

User generated image
Avatar of masnrock
masnrock
Flag of United States of America image

The error message they recieve is attached to this question. Basically, IE is telling us to turn on TLS 1.0, TLS 1,1 and TLS 1.2
Your attachment didn't make it. Please try attaching again. But also, why would TLS be off at all? Have you checked your computers on whether this is indeed the case? And if so, turn them on. You especially need to have TLS 1.2 on (the others depend on your security rules).
Check the IE security settings for encryption and check the one chrome has.
sounds as though IE/EDge are unable to negotiate a secure connection to the pages in question, presumably no secure access on that site is possible from IE/Edge through potentially disabling of encryption schemes available for the connection.
Avatar of zito2000

ASKER

@masnrock, thank you for letting me know about the attachment.

I re-uploaded and embedded it.
open IE internet options/options and see under advanced, security section make sure you have check marks in use TLS 1.1 TLS 1.2 TLS 1.0
And I would tell you the same thing: turn on TLS 1.0, 1.1, and 1.2 in Internet Options on the workstations. By having them off, you're preventing IE from connecting to any website with modern security. SSL is outdated has been shown to be insecure.

Is There a way to see which protocols are being used in IIS and how we can modify them if necessary?
You could use IISCrypto, but your issue seems to be more on the client side. Get the TLS settings straight, then assess whether you really need to tinker with the server.
@masnrock, and @arnold,

I was able to confirm that enabling all three versions of TLS on ie advanced setting did in fact work, however, this is a page that costumers outside our network need to be able to access and do not have technical expertise to troubleshoot.

@masnrock, you mentioned a utility called IISCrypto that can easily modify security protocol settings on our server if need be... I know that there are customers using ie as their browser of choice, but they will most likely not be able to view the page with their current settings and won't know to use a different browser, ot switch to chrome.

Besides IISCrypto, is there an actual setting in IIS, or place to go in IIS to view which security protocols are actually being used with out needing to use a third party tool?
I was able to confirm that enabling all three versions of TLS on ie advanced setting did in fact work, however, this is a page that costumers outside our network need to be able to access and do not have technical expertise to troubleshoot.
That's the thing, TLS should be on to begin with. I explicitly mentioned why in my last comment: You're essentially barring yourself from a lot secure sites by have TLS turned off, especially online shopping sites (PCI rules even dictate what version of TLS has to be in use). Financial sites also would be something that wouldn't be usable because of security rules.

@masnrock, you mentioned a utility called IISCrypto that can easily modify security protocol settings on our server if need be... I know that there are customers using ie as their browser of choice, but they will most likely not be able to view the page with their current settings and won't know to use a different browser, ot switch to chrome.
Basically, the registry. But like I said previously, TLS is essential for HTTPS connections. SSL has been compromised for quite a while. I don't know what kind of data your server is hosting (or what regulations surround it), but I wouldn't even contemplate the idea of weakening the security.
Client systems commonly through the application of updates have these settings updated, higher tls are enabled.
In an AD environment, these settings might be controlled through a GPO.
ASKER CERTIFIED SOLUTION
Avatar of arnold
arnold
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you very much for the help and assistance @arnold and @masnrock, based on your feedback, I will reassess the issue and move forward with a different security approach.

Customer's ease of use is important to our company, but so is network security.