We help IT Professionals succeed at work.

How do I find out which security protocols are being used on a windows 2008 R2 IIS server?

I would like to find a way to see which security protocols/ciphers are being used with IIS 6 on our windows 2008r2 server.
Where is the right place in the registry, or IIS to look for these settings?

Thanks,
Comment
Watch Question

SteveArchitect/Designer

Commented:
if youre not already aware how to do it id recommend a tool like iis crypto
https://www.nartac.com/Products/IISCrypto/

its farly easy to do via regedit but this tool does the work for you!
Distinguished Expert 2019

Commented:
Here is an article that discusses enabling TLS 1 1 and 1.2: https://community.ipswitch.com/s/article/How-to-Enable-TLS-1-1-TLS-1-2-on-Windows-Server-2008-R2

Ideally, you only have TLS 1.2 enabled, but you may need 1.1 also. TLS 1.0 and all versions of SSL should be disabled, as they are all insecure.

Herr is an article on ciphers: https://support.hostway.com/hc/en-us/articles/360000024630-Managing-Windows-Server-Cipher-Suites-?mobile_site=true
Insecure ciphers should all be disabled.

Now you see why I had recommended IISCrypto on your last question. While you can use the registry, you are making things unnecessarily hard in doing so.
Network Manager
Commented:
Thanks for the help folks,

I ended up just enabling TLS 1.2 in the registry on the IIS server and that fixed the problem.

I will look more into IISCrypto, as it seems like a popular tool in the IT industry...