Enforcing SSL 3.0 and removing weak encryption vulnerability over SSL ( IIS 6.0 and ISA )

re: Enforcing SSL 3.0 and removing weak encryption vulnerability over SSL ( IIS 6.0 and ISA )

sathai — Thu, 01 Oct 2009 23:52:03 GMT

This help me on the PCI test, Thanks.

re: Enforcing SSL 3.0 and removing weak encryption vulnerability over SSL ( IIS 6.0 and ISA )

Anonymous — Wed, 11 Mar 2009 15:30:10 GMT

Very interesting artilce

Im not very familiar in cryptography but I received some questions about a customer, so Im trying to get up to speed...

My questions is, in IIS6, if we install a Certificat that is Version3 (SHA-1, RSA1024,..), do we still need to perform Registry changes ?

Thks

re: Enforcing SSL 3.0 and removing weak encryption vulnerability over SSL ( IIS 6.0 and ISA )

Anonymous — Tue, 10 Mar 2009 23:45:11 GMT

Yes, if you go to http://www.serversniff.net, you can use their free tool to check the web server:

http://www.serversniff.net/content.php?do=ssl

re: Enforcing SSL 3.0 and removing weak encryption vulnerability over SSL ( IIS 6.0 and ISA )

Anonymous — Thu, 05 Mar 2009 21:50:04 GMT

I have made the registry changes as required and rebooted the server.

If I then test it using a browser with only SSL 2.0 Enabled, I can still get to the web site (over HTTPS). Based on this test, the registry change had no effect.

Is this not a valid method of testing?

Is there a tool I can use to verify what level of SSL the server is requiring?

Thanks.

https:// proxy server | Digg hot tags

https:// proxy server | Digg hot tags — Fri, 12 Dec 2008 06:44:04 GMT

Pingback from https:// proxy server | Digg hot tags