I'm trying to stop a server using Diffie Hellman key exchanges of less than 2048 bits, but I'm getting confusing results.
Get-TlsCipherSuite | Format-Table Name, Exchange, Cipher, Hash, Certificate
and I can see
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA
......all of which are known to use only 1024 bits
I've run IIS crypto 3.2 and set the DHE minimum key length to 2048 and rebooted...but I can still see the 4 cipher suites above when I run the
Get-TlsCipherSuite command. Is IIS crypto actually doing what I want it to do?
Am I misunderstanding something?