We have several Windows 2008 and 2012 servers which are showing the, "SSL Server Allows Anonymous Authentication Vulnerability"
What is the best way to remediate this vulnerability without affecting clients.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The issue of Anonymous Authentication in SSL means that the server is accepting ciphers which don't require authentication of the server. This authentication is usually done by checking the servers certificate. Using a cipher with anonymous authentication means that no authentication of the server will be done inside the TLS handshake and thus the connection is open for man in the middle attacks.
It is unknown which kind of clients you have. But if you have just browsers as clients then you could simply disable anonymous authentication in the server since browsers don't use these ciphers anyway.
For any other clients you would actually have a look at the specific client and if it uses anonymous authentication. But most clients will also not use anonymous authentication by default so the chances are high that no client will be affected when switching these insecure ciphers off.