IIS: Disabling Weak SSL Protocols and Ciphers
It's no secret by now that if your web site sees credit card numbers (even if they are passed to a third party gateway) you need to comply with the PCI DSS standards.
Requirement 4.1 states:
Use strong cryptography and security protocols such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open, public networks.
If you are running IIS there are typically several weak Protocols and Ciphers enabled, such as SSLv2, and 40-56 bit key ciphers. The Internet Information Services Management Console doesn't have a GUI to let you disable these protocols and ciphers. You need to use Regedit to make several registry changes in order to disable these.
While doing some consulting work last week a client mentioned how useful it would be to have a product for toggling ciphers and protocols in IIS. I agreed, and built the following:
I also built a web based tool to test your server for SSLv2. The testing tool works on both IIS and Apache Web servers.
- Request Filtering in IIS 7 Howto - February 16, 2010
- Howto Disable the Server Header in IIS - December 6, 2005
- SameSite Cookies with IIS - May 14, 2018
- HackMyCF Adds SSL/TLS Scanner - May 27, 2015
- Blocking .svn and .git Directories on Apache or IIS - October 15, 2013
- What is the difference between ASCII Chr(10) and Chr(13)
- Fixinator and Foundeo Security Bundle
- Running CFML on AWS Lambda with FuseLess Slides
- Updating Java on ColdFusion or Lucee
- ColdFusion returning empty response with server-error: true
- Careful applying CF11u16, CF2016u8, CF2018u2
- Sessions don't work in Chrome but do in IE
- csrfVerifyToken does not invalidate the token