2

Particularly this question is focused for Windows Server 2008 R2.

I know the registry can be used to modify particular entries to disable weak ciphers if they are known.

I saw this tool: http://www.defensia.co.il/2011/05/12/hardening-iis-ssl-with-iiscrypto-disabling-weak-ciphers/ but I'm not familiar with the creator so I'm not too trusting of it.

I'm sure there may be a template to use of some sort, but I'm not familiar with the exact details of that.

Improve this question
4
  • Are you only talking about SSL/TLS on IIS, or about other kinds of encryption too?
    – CodesInChaos
    Commented Jun 29, 2012 at 10:55
  • Mainly vulnerabilities for IIS so SSL/TLS would be most definitely desired to modify. Otherwise, I'm not sure if other ciphers for encryption would be necessary unless they pose a threat and serve no major purpose other than expose vulnerabilities.
    – Sn3akyP3t3
    Commented Jun 30, 2012 at 1:28
  • Are you looking for a tool/script to disable them? Generally for platforms we would just update the Group Policy and push it out to servers/desktops, and for IIS/Apache we would update the config to disable weak ciphers.
    – Rory Alsop ♦
    Commented Jul 2, 2012 at 13:52
  • If a tool is known that would be extra knowledge, but ideally the Group Policy rules you mention would be better. Do you have reference to a book or link that identifies where those settings are?
    – Sn3akyP3t3
    Commented Jul 5, 2012 at 3:00

1 Answer 1

Reset to default
2

For SSL/TLS, you can control this setting through group policy on 2008 or later systems (http://msdn.microsoft.com/en-us/library/windows/desktop/bb870930%28v=vs.85%29.aspx) The setting is called SSL Cipher Suite Order and is inside of the Administrative Templates/Network hierarchy.

If you need to modify the behavior of other applications that utilize the SChannel crypto framework on the system, you can modify the registry values directly http://support.microsoft.com/kb/245030.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .