IIS Site breaks after disabling SSLv3
Warning about needing "authorization" when booking ticket
You have (3^2 + 2^3 + 2^2) Guesses Left. Figure out the Last one
Why was this person allowed to become Grand Maester?
Why not invest in precious metals?
Arriving at the same result with the opposite hypotheses
How to decline a wedding invitation from a friend I haven't seen in years?
A word that means "blending into a community too much"
bmatrix: how to align elements' subscripts?
Has there been a multiethnic Star Trek character?
1980s live-action movie where individually-coloured nations on clouds fight
Determining fair price for profitable mobile app business
Why are trash cans referred to as "zafacón" in Puerto Rico?
What is the maximum number of net attacks that one can make in a round?
Non-aqueous eyes?
How can a disk without a partition be "partitioned" without losing data?
Is it possible to have a wealthy country without a middle class?
Generate basis elements of the Steenrod algebra
Can I use trees and other climbable objects to get on Tenser's Floating Disk?
Does the Long March-11 increase its thrust after clearing the launch tower?
How to communicate to my GM that not being allowed to use stealth isn't fun for me?
Which languages would be most useful in Europe at the end of the 19th century?
If every company in the economy earns zero economic profit, can they contribute to real economic growth?
Russian word for a male zebra
How can I get an unreasonable manager to approve time off?
IIS Site breaks after disabling SSLv3
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
1
I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled and my client is establishing a TLS 1.2 connection so I don't understand why disabling SSLv3 breaks the site.
I am not the strongest with encryption but know the basics so any insight as to what my be causing this issue is appreciated. Below is the PoSH script that I ran (the SSLv3 Reg keys I changed to a value of 1 to bring the site back online):
# Add and Enable TLS 1.0 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Add and Enable TLS 1.1 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -name 'Enabled' -value 1 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Add and Enable TLS 1.2 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -name 'Enabled' -value 1 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Disable SSL 2.0 (PCI Compliance)
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Server' -name Enabled -value 0 -PropertyType 'DWord' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Client' -name Enabled -value 0 -PropertyType 'DWord' -Force
# NOTE: If you disable SSL 3.0 then you may lock out some people still using
# Windows XP with IE6/7. Without SSL 3.0 enabled, there is no protocol available
# for these people to fall back. Safer shopping certifications may require that
# you disable SSLv3.
#
# Disable SSL 3.0 (PCI Compliance) and enable "Poodle" protection
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Server' -name Enabled -value 0 -PropertyType 'DWord' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Client' -name Enabled -value 0 -PropertyType 'DWord' -Force
Write-Host 'After the system has been rebooted you can verify your server configuration at https://www.ssllabs.com/ssltest/'
Write-Host -ForegroundColor Red 'A computer restart is required to apply settings. Restart computer now?'
Restart-Computer -Force -Confirm
windows-server-2008-r2 ssl iis-7.5 tls poodle
asked Nov 26 '14 at 22:17
n0madn0mad
62
add a comment |
1
I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled and my client is establishing a TLS 1.2 connection so I don't understand why disabling SSLv3 breaks the site.
I am not the strongest with encryption but know the basics so any insight as to what my be causing this issue is appreciated. Below is the PoSH script that I ran (the SSLv3 Reg keys I changed to a value of 1 to bring the site back online):
# Add and Enable TLS 1.0 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Add and Enable TLS 1.1 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -name 'Enabled' -value 1 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Add and Enable TLS 1.2 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -name 'Enabled' -value 1 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Disable SSL 2.0 (PCI Compliance)
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Server' -name Enabled -value 0 -PropertyType 'DWord' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Client' -name Enabled -value 0 -PropertyType 'DWord' -Force
# NOTE: If you disable SSL 3.0 then you may lock out some people still using
# Windows XP with IE6/7. Without SSL 3.0 enabled, there is no protocol available
# for these people to fall back. Safer shopping certifications may require that
# you disable SSLv3.
#
# Disable SSL 3.0 (PCI Compliance) and enable "Poodle" protection
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Server' -name Enabled -value 0 -PropertyType 'DWord' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Client' -name Enabled -value 0 -PropertyType 'DWord' -Force
Write-Host 'After the system has been rebooted you can verify your server configuration at https://www.ssllabs.com/ssltest/'
Write-Host -ForegroundColor Red 'A computer restart is required to apply settings. Restart computer now?'
Restart-Computer -Force -Confirm
windows-server-2008-r2 ssl iis-7.5 tls poodle
asked Nov 26 '14 at 22:17
n0madn0mad
62
1
Hmm.. is the 443 listening port still open with SSLv3 is disabled? If so, then maybe do a packet capture and see where in the SSL process it's failing?
– Shane Madden♦
Nov 26 '14 at 22:42
I'm with @ShaneMadden on this one-- we need to see what's happening when you've got SSLv3 disabled. A packet capture of the failing state would be helpful.
– Evan Anderson
Nov 26 '14 at 22:53
Thanks gents. I plan to do just as suggested but will need to wait until I am allowed to take down the site again to run the test which likely won't be until after the holiday.
– n0mad
Nov 26 '14 at 23:28
add a comment |
1
1
1
I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled and my client is establishing a TLS 1.2 connection so I don't understand why disabling SSLv3 breaks the site.
I am not the strongest with encryption but know the basics so any insight as to what my be causing this issue is appreciated. Below is the PoSH script that I ran (the SSLv3 Reg keys I changed to a value of 1 to bring the site back online):
# Add and Enable TLS 1.0 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Add and Enable TLS 1.1 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -name 'Enabled' -value 1 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Add and Enable TLS 1.2 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -name 'Enabled' -value 1 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Disable SSL 2.0 (PCI Compliance)
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Server' -name Enabled -value 0 -PropertyType 'DWord' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Client' -name Enabled -value 0 -PropertyType 'DWord' -Force
# NOTE: If you disable SSL 3.0 then you may lock out some people still using
# Windows XP with IE6/7. Without SSL 3.0 enabled, there is no protocol available
# for these people to fall back. Safer shopping certifications may require that
# you disable SSLv3.
#
# Disable SSL 3.0 (PCI Compliance) and enable "Poodle" protection
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Server' -name Enabled -value 0 -PropertyType 'DWord' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Client' -name Enabled -value 0 -PropertyType 'DWord' -Force
Write-Host 'After the system has been rebooted you can verify your server configuration at https://www.ssllabs.com/ssltest/'
Write-Host -ForegroundColor Red 'A computer restart is required to apply settings. Restart computer now?'
Restart-Computer -Force -Confirm
windows-server-2008-r2 ssl iis-7.5 tls poodle
asked Nov 26 '14 at 22:17
n0madn0mad
62
I am trying to disable SSLv3 on a 2008 R2 web server that runs IIS 7.5 but as soon as I disable SSLv3 and reboot, the website is no longer reachable. I ran a packet capture with SSLv3 still enabled and my client is establishing a TLS 1.2 connection so I don't understand why disabling SSLv3 breaks the site.
I am not the strongest with encryption but know the basics so any insight as to what my be causing this issue is appreciated. Below is the PoSH script that I ran (the SSLv3 Reg keys I changed to a value of 1 to bring the site back online):
# Add and Enable TLS 1.0 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.0Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Add and Enable TLS 1.1 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -name 'Enabled' -value 1 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.1Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Add and Enable TLS 1.2 for client and server SCHANNEL communications
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -name 'Enabled' -value 1 -PropertyType 'DWord' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS 1.2Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force
# Disable SSL 2.0 (PCI Compliance)
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Server' -name Enabled -value 0 -PropertyType 'DWord' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 2.0Client' -name Enabled -value 0 -PropertyType 'DWord' -Force
# NOTE: If you disable SSL 3.0 then you may lock out some people still using
# Windows XP with IE6/7. Without SSL 3.0 enabled, there is no protocol available
# for these people to fall back. Safer shopping certifications may require that
# you disable SSLv3.
#
# Disable SSL 3.0 (PCI Compliance) and enable "Poodle" protection
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Server' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Server' -name Enabled -value 0 -PropertyType 'DWord' -Force
md 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Client' -Force
New-ItemProperty -path 'HKLM:SYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL 3.0Client' -name Enabled -value 0 -PropertyType 'DWord' -Force
Write-Host 'After the system has been rebooted you can verify your server configuration at https://www.ssllabs.com/ssltest/'
Write-Host -ForegroundColor Red 'A computer restart is required to apply settings. Restart computer now?'
Restart-Computer -Force -Confirm
windows-server-2008-r2 ssl iis-7.5 tls poodle
windows-server-2008-r2 ssl iis-7.5 tls poodle
asked Nov 26 '14 at 22:17
n0madn0mad
62
asked Nov 26 '14 at 22:17
n0madn0mad
62
asked Nov 26 '14 at 22:17
n0madn0mad
62
asked Nov 26 '14 at 22:17
n0madn0mad
62
asked Nov 26 '14 at 22:17
n0madn0mad
62
62
1
Hmm.. is the 443 listening port still open with SSLv3 is disabled? If so, then maybe do a packet capture and see where in the SSL process it's failing?
– Shane Madden♦
Nov 26 '14 at 22:42
I'm with @ShaneMadden on this one-- we need to see what's happening when you've got SSLv3 disabled. A packet capture of the failing state would be helpful.
– Evan Anderson
Nov 26 '14 at 22:53
Thanks gents. I plan to do just as suggested but will need to wait until I am allowed to take down the site again to run the test which likely won't be until after the holiday.
– n0mad
Nov 26 '14 at 23:28
add a comment |
1
Hmm.. is the 443 listening port still open with SSLv3 is disabled? If so, then maybe do a packet capture and see where in the SSL process it's failing?
– Shane Madden♦
Nov 26 '14 at 22:42
I'm with @ShaneMadden on this one-- we need to see what's happening when you've got SSLv3 disabled. A packet capture of the failing state would be helpful.
– Evan Anderson
Nov 26 '14 at 22:53
Thanks gents. I plan to do just as suggested but will need to wait until I am allowed to take down the site again to run the test which likely won't be until after the holiday.
– n0mad
Nov 26 '14 at 23:28
1
1
Hmm.. is the 443 listening port still open with SSLv3 is disabled? If so, then maybe do a packet capture and see where in the SSL process it's failing?
– Shane Madden♦
Nov 26 '14 at 22:42
Hmm.. is the 443 listening port still open with SSLv3 is disabled? If so, then maybe do a packet capture and see where in the SSL process it's failing?
– Shane Madden♦
Nov 26 '14 at 22:42
I'm with @ShaneMadden on this one-- we need to see what's happening when you've got SSLv3 disabled. A packet capture of the failing state would be helpful.
– Evan Anderson
Nov 26 '14 at 22:53
I'm with @ShaneMadden on this one-- we need to see what's happening when you've got SSLv3 disabled. A packet capture of the failing state would be helpful.
– Evan Anderson
Nov 26 '14 at 22:53
Thanks gents. I plan to do just as suggested but will need to wait until I am allowed to take down the site again to run the test which likely won't be until after the holiday.
– n0mad
Nov 26 '14 at 23:28
Thanks gents. I plan to do just as suggested but will need to wait until I am allowed to take down the site again to run the test which likely won't be until after the holiday.
– n0mad
Nov 26 '14 at 23:28
add a comment |
1 Answer
1
active
oldest
votes
0
I faced the same problem. Go to IIS and Edit Bindings of your website.
Remove the https binding and then re enter it.
It will work again.
I hope this helps you.
answered Feb 11 '16 at 21:49
Shadi NamroutiShadi Namrouti
1113
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f647422%2fiis-site-breaks-after-disabling-sslv3%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
I faced the same problem. Go to IIS and Edit Bindings of your website.
Remove the https binding and then re enter it.
It will work again.
I hope this helps you.
answered Feb 11 '16 at 21:49
Shadi NamroutiShadi Namrouti
1113
add a comment |
0
I faced the same problem. Go to IIS and Edit Bindings of your website.
Remove the https binding and then re enter it.
It will work again.
I hope this helps you.
answered Feb 11 '16 at 21:49
Shadi NamroutiShadi Namrouti
1113
add a comment |
0
0
0
I faced the same problem. Go to IIS and Edit Bindings of your website.
Remove the https binding and then re enter it.
It will work again.
I hope this helps you.
answered Feb 11 '16 at 21:49
Shadi NamroutiShadi Namrouti
1113
I faced the same problem. Go to IIS and Edit Bindings of your website.
Remove the https binding and then re enter it.
It will work again.
I hope this helps you.
answered Feb 11 '16 at 21:49
Shadi NamroutiShadi Namrouti
1113
answered Feb 11 '16 at 21:49
Shadi NamroutiShadi Namrouti
1113
answered Feb 11 '16 at 21:49
Shadi NamroutiShadi Namrouti
1113
answered Feb 11 '16 at 21:49
Shadi NamroutiShadi Namrouti
1113
1113
add a comment |
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f647422%2fiis-site-breaks-after-disabling-sslv3%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Hmm.. is the 443 listening port still open with SSLv3 is disabled? If so, then maybe do a packet capture and see where in the SSL process it's failing?
– Shane Madden♦
Nov 26 '14 at 22:42
I'm with @ShaneMadden on this one-- we need to see what's happening when you've got SSLv3 disabled. A packet capture of the failing state would be helpful.
– Evan Anderson
Nov 26 '14 at 22:53
Thanks gents. I plan to do just as suggested but will need to wait until I am allowed to take down the site again to run the test which likely won't be until after the holiday.
– n0mad
Nov 26 '14 at 23:28