4

I would like any seasoned analysts in network security & cryptography to help me confirm the following case.

I have a .NET console application to get information from a web service hosted in the Exchange server 2013. Every time I execute the console application, I see in Wireshark that the TLS 1.0 is refused by the Exchange server. What I did to check the list of supported SSL protocols on the Exchange server was to use nmap. Below is the command

nmap -p 443 --script ssl-enum-ciphers exchange.contoso.com

Output is as follows

enter image description here

However, there is no cipher supported by the destination server that is in the SSL packet sent from the client. Below is the cipher suites of TLS 1.0 the client sends to the Exchange server.

enter image description here

With this information, could I confirm that the destination server refuses TLS 1.0 because there is no cipher supported accordingly? If so, how can I sort the problem out? I was thinking allowing more SSL protocols in Windows Server (registry modification like this article https://support.microsoft.com/en-us/kb/187498)

Any suggestion would be very much appreciated.

[Updated]The client's OS is Windows Server 2008. Upon Steffen's answer, I have to figure out how to make the console application or the client to use TLS 1.2.

I would like to put more updates. When I opened the website (with SSL), I noticed that the destination server accepted the TLS 1.0 protocol.

Cipher suite of client-hello packet

enter image description here

The response from server enter image description here

Perhaps I have to put something in my .NET console application to specify the protocol it should use by default.

Improve this question
3
  • Sidenote: Also get rid of the cipher suites where Nmap says "broken". You don't want anonymous Diffie-Hellman.
    – StackzOfZtuff
    Commented May 31, 2015 at 20:08
  • Not sure if I understand what you mean @StackzOfZtuff
    – EagleDev
    Commented May 31, 2015 at 20:13
  • In the Nmap output that you posted, there are lines that say "broken" at the end. These cipher suites are not good.
    – StackzOfZtuff
    Commented May 31, 2015 at 20:40

1 Answer 1

Reset to default
2

Yes, the server supports only RC4-SHA with TLS 1.0 and TLS 1.1. With TLS 1.2 it supports several more ciphers. Since all of these (GCM) ciphers where introduced with TLS 1.2 they are not available for TLS 1.0 and TLS 1.1 connections.

You can solve the problem in the following ways:

  • Have the client use TLS 1.2 so it can offer more ciphers. The protocol is available since Windows 7.
  • Enable support for RC4-SHA4 at the client. This cipher is often disabled for security reasons.
  • Enable more TLS 1.0 ciphers at the server side.
Improve this answer
6
  • Thank you Steffen. I don't have rights on the server to check. However I checked on the client via registry, there was no protocol or cipher to be disabled. Is there any security patch included in the operating system that disables those ciphers and protocols? Perhaps the rule is included in DLL that is not configurable.
    – EagleDev
    Commented May 31, 2015 at 18:50
  • I think the part of the question relating to the context of this site is answered. For specific questions on how to set ciphers inside a program, changing the OS configuration for ciphers etc please try a search engine and if you don't find anything there head over to stackoverflow.com or superuser.com. And if you do that don't forget to add the necessary details about your environment like versions of libraries and OS and what you've tried already (in detail) because how things are done differ between versions of libraries and OS.
    – Steffen Ullrich
    Commented May 31, 2015 at 19:01
  • Since you have updated the question with more information about your environment: It might be that you have installed the update for support.microsoft.com/en-us/kb/2868725 which disables RC4 by default on the client side. TLS 1.2 is not available for Windows 2008, only for 2008 R2.
    – Steffen Ullrich
    Commented May 31, 2015 at 19:15
  • Thank you for your suggestion Steffen. I just updated one more cases. Perhaps the server-level protocol has nothing to do but my .NET application. I'm looking into this one simple-talk.com/dotnet/.net-framework/…
    – EagleDev
    Commented May 31, 2015 at 19:38
  • There is nothing new in the updated question. You see that the server can talk with TLS 1.0 and will use RC4-SHA. That's the same you can already see in the output from nmap. But unfortunately your application does not offer use RC4-SHA so it can't be used.
    – Steffen Ullrich
    Commented May 31, 2015 at 19:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .