{"id":26,"date":"2010-06-22T16:36:09","date_gmt":"2010-06-22T20:36:09","guid":{"rendered":"http:\/\/www.amixa.com\/blog\/?p=26"},"modified":"2010-06-22T16:39:01","modified_gmt":"2010-06-22T20:39:01","slug":"ssl-weak-encryption-algorithms-how-to-disable-them-under-iis","status":"publish","type":"post","link":"https:\/\/www.amixa.com\/blog\/2010\/06\/22\/ssl-weak-encryption-algorithms-how-to-disable-them-under-iis\/","title":{"rendered":"SSL Weak Encryption Algorithms – how to disable them under IIS"},"content":{"rendered":"

Chances are if you are reading this you’ve failed a “Trustkeeper Scan” – with\u00a0“Low severity” – due to having weak SSL encryption algorithms enabled on IIS.<\/p>\n

It’s pretty easy to solve this, but if you read the microsoft KB article<\/a> it looks pretty complicated.<\/p>\n

Launch regedit and go to this key:<\/p>\n

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers<\/strong><\/span><\/pre>\n
You basically want to disable everything that has less than 128 bit encryption.\u00a0 On one of my servers, the ones with red arrows below need to be disabled:<\/p>\n
\"CLICK<\/a>
CLICK FOR LARGER IMAGE<\/p><\/div>\n
So on each one of these, you want to “Right click”, add a DWORD, name it “Enabled” and set the Hex value to 00000000\u00a0 (eight zeros).<\/p>\n
Repeat for each one that has less than 128 bit length, and then restart your server.<\/p>\n
You probably also need to reschedule a security scan so that your changes can be verified, and as always, please double check your SSL protected site with at least two different web browsers and make sure you can get into SSL mode with them both on your site.<\/p>\n","protected":false},"excerpt":{"rendered":"
Chances are if you are reading this you’ve failed a “Trustkeeper Scan” – with\u00a0“Low severity” – due to having weak SSL encryption algorithms enabled on IIS. It’s pretty easy to solve this, but if you read the microsoft KB article it looks pretty complicated. Launch regedit and go to this key: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers You basically want to disable everything that has<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[7,5,8,101,9],"class_list":["post-26","post","type-post","status-publish","format-standard","hentry","category-random-bits","tag-encryption","tag-iis","tag-microsoft-windows-server","tag-ssl","tag-trustkeeper-scan"],"_links":{"self":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/26","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/comments?post=26"}],"version-history":[{"count":4,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/26\/revisions"}],"predecessor-version":[{"id":32,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/26\/revisions\/32"}],"wp:attachment":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/media?parent=26"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/categories?post=26"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/tags?post=26"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}