Particularly this question is focused for Windows Server 2008 R2.

I know the registry can be used to modify particular entries to disable weak ciphers if they are known.

I saw this tool: http://www.defensia.co.il/2011/05/12/hardening-iis-ssl-with-iiscrypto-disabling-weak-ciphers/ but I'm not familiar with the creator so I'm not too trusting of it.

I'm sure there may be a template to use of some sort, but I'm not familiar with the exact details of that.

  • Are you only talking about SSL/TLS on IIS, or about other kinds of encryption too? – CodesInChaos Jun 29 '12 at 10:55
  • Mainly vulnerabilities for IIS so SSL/TLS would be most definitely desired to modify. Otherwise, I'm not sure if other ciphers for encryption would be necessary unless they pose a threat and serve no major purpose other than expose vulnerabilities. – Sn3akyP3t3 Jun 30 '12 at 1:28
  • Are you looking for a tool/script to disable them? Generally for platforms we would just update the Group Policy and push it out to servers/desktops, and for IIS/Apache we would update the config to disable weak ciphers. – Rory Alsop Jul 2 '12 at 13:52
  • If a tool is known that would be extra knowledge, but ideally the Group Policy rules you mention would be better. Do you have reference to a book or link that identifies where those settings are? – Sn3akyP3t3 Jul 5 '12 at 3:00

For SSL/TLS, you can control this setting through group policy on 2008 or later systems (http://msdn.microsoft.com/en-us/library/windows/desktop/bb870930%28v=vs.85%29.aspx) The setting is called SSL Cipher Suite Order and is inside of the Administrative Templates/Network hierarchy.

If you need to modify the behavior of other applications that utilize the SChannel crypto framework on the system, you can modify the registry values directly http://support.microsoft.com/kb/245030.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.