Amixa Blog – Website & IT services in Western Pennsylvania

If you have undergone a “Trustkeeper Scan” and failed due to your Microsoft web server using SSLv2, then read on.

NOTE: PLEASE READ THIS POST IN OUR BLOG HERE.  It is TWO YEARS NEWER and simplifies most of the tasks regarding SSL settings.

SSLv2 is considered a “medium” security risk and will cause your scan to FAIL, so therefore to be PCI-DSS compliant (for credit card companies), you need to disable it via the registry on your Windows server running IIS 3 or later.

The easiest way to do this is to read this KB article from Microsoft.

In a nutshell, you need to go to this registry key

HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Then locate the SSL 2.0 key

• Click on the “Server” node.
• On the Edit menu, click Add Value.
• In the Data Type list, click DWORD.
• In the Value Name box, type Enabled, and then click OK.  Note: If this value is present, just double-click the value to edit its current value.
• Type 00000000 in Binary Editor to set the value of the new key equal to “0”.
• Click OK. Restart the computer
• if applicable, reschedule the security scan