4

I would like any seasoned analysts in network security & cryptography to help me confirm the following case.

I have a .NET console application to get information from a web service hosted in the Exchange server 2013. Every time I execute the console application, I see in Wireshark that the TLS 1.0 is refused by the Exchange server. What I did to check the list of supported SSL protocols on the Exchange server was to use nmap. Below is the command

nmap -p 443 --script ssl-enum-ciphers exchange.contoso.com

Output is as follows

enter image description here

However, there is no cipher supported by the destination server that is in the SSL packet sent from the client. Below is the cipher suites of TLS 1.0 the client sends to the Exchange server.

enter image description here

With this information, could I confirm that the destination server refuses TLS 1.0 because there is no cipher supported accordingly? If so, how can I sort the problem out? I was thinking allowing more SSL protocols in Windows Server (registry modification like this article https://support.microsoft.com/en-us/kb/187498)

Any suggestion would be very much appreciated.

[Updated]The client's OS is Windows Server 2008. Upon Steffen's answer, I have to figure out how to make the console application or the client to use TLS 1.2.

I would like to put more updates. When I opened the website (with SSL), I noticed that the destination server accepted the TLS 1.0 protocol.

Cipher suite of client-hello packet

enter image description here

The response from server enter image description here

Perhaps I have to put something in my .NET console application to specify the protocol it should use by default.

  • Sidenote: Also get rid of the cipher suites where Nmap says "broken". You don't want anonymous Diffie-Hellman. – StackzOfZtuff May 31 '15 at 20:08
  • Not sure if I understand what you mean @StackzOfZtuff – EagleDev May 31 '15 at 20:13
  • In the Nmap output that you posted, there are lines that say "broken" at the end. These cipher suites are not good. – StackzOfZtuff May 31 '15 at 20:40
2

Yes, the server supports only RC4-SHA with TLS 1.0 and TLS 1.1. With TLS 1.2 it supports several more ciphers. Since all of these (GCM) ciphers where introduced with TLS 1.2 they are not available for TLS 1.0 and TLS 1.1 connections.

You can solve the problem in the following ways:

  • Have the client use TLS 1.2 so it can offer more ciphers. The protocol is available since Windows 7.
  • Enable support for RC4-SHA4 at the client. This cipher is often disabled for security reasons.
  • Enable more TLS 1.0 ciphers at the server side.
  • Thank you Steffen. I don't have rights on the server to check. However I checked on the client via registry, there was no protocol or cipher to be disabled. Is there any security patch included in the operating system that disables those ciphers and protocols? Perhaps the rule is included in DLL that is not configurable. – EagleDev May 31 '15 at 18:50
  • I think the part of the question relating to the context of this site is answered. For specific questions on how to set ciphers inside a program, changing the OS configuration for ciphers etc please try a search engine and if you don't find anything there head over to stackoverflow.com or superuser.com. And if you do that don't forget to add the necessary details about your environment like versions of libraries and OS and what you've tried already (in detail) because how things are done differ between versions of libraries and OS. – Steffen Ullrich May 31 '15 at 19:01
  • Since you have updated the question with more information about your environment: It might be that you have installed the update for support.microsoft.com/en-us/kb/2868725 which disables RC4 by default on the client side. TLS 1.2 is not available for Windows 2008, only for 2008 R2. – Steffen Ullrich May 31 '15 at 19:15
  • Thank you for your suggestion Steffen. I just updated one more cases. Perhaps the server-level protocol has nothing to do but my .NET application. I'm looking into this one simple-talk.com/dotnet/.net-framework/… – EagleDev May 31 '15 at 19:38
  • There is nothing new in the updated question. You see that the server can talk with TLS 1.0 and will use RC4-SHA. That's the same you can already see in the output from nmap. But unfortunately your application does not offer use RC4-SHA so it can't be used. – Steffen Ullrich May 31 '15 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.