Fix SSL Vulnerability Part 3 of 3: Using IIS Crypto tool to disable weak ciphers and protocols

As a webserver administrator/systems administrator, you must ensure that your webserver is using strong ciphers and protocols. Your webserver can easily be flagged for vulnerabilities if you use weak ciphers and protocols. Your webserver would then be not compliant with your organization's security policies and could be vulnerable to network security hacks. 

You may receive "Web Server Supports Weak SSL Encryption Certificates" message on your network security vulnerability report if you are using weak ciphers or protocols. Enforcing the 128-bit SSL keys might not be possible in all situations because keys distributed by some vendors use 40-bit. When configuring SSL communication, the recommendation is to use SSLv3 since it fixes most of the flaws found in SSLv2. There is no known attack for breaking SSLv3 security.

There are lot of other vulnerabilities associated with SSLv2 and TLS 1.0, TLS 1.1 protocols. If you search other places, you would find tons of ways to disable vulnerable protocols in Windows registry editor etc. I recently came across "IIS Crypto" software which helps disable weak ciphers and protocols through a GUI interface.

To enable/disable the protocols/ciphers, click the "PCI" or "FIPS 140-2" button and then manually check/uncheck the protocols and ciphers that you want to enable. A restart of the Operating System is required before the settings can come into effect.

Fix SSL Vulnerability Part 2 of 3: How to ensure which protocol your server is using?

To check the protocol that your web server is using for https type traffic, you would need to download and install "OpenSSL" utility on the computer from where you will be making connections to the web server.

Please see the instructions below to download and install "OpenSSL":-

1. Download "OpenSSL" from http://slproweb.com/products/Win32OpenSSL.html

2.As of June 11th 2012, you can download either "Win32 OpenSSL v1.0.1c Light" (for 32-bit Windows) or "Win64 OpenSSL v1.0.1c Light" (for 64-bit Windows)

3. It is recommended that you download and install the "Visual C++ 2008 Redistributables" as well before installing "OpenSSL" binaries. Please install the 32-bit or 64-bit version depending upon your OS type.

4. Once the "C++" and "OpenSSL" binaries are installed on the computer you should be ready to test the protocol that your webserver is using.

i. Open cmd on the computer where you installed "OpenSSL"

ii. Change path to the OpenSSL\bin directory

iii. Type the command: "openssl s_client -ssl2 -connect SERVERNAME:443" where SERVERNAME is the hostname (or FQDN) or IP address of your webserver and port 443 is your default https port.

iv. If your webserver does not support SSLv2, then you should receive output similar to this:-


openssl s_client -ssl2 -connect SERVERNAME:443
CONNECTED(00000003)
458:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:428:


v. If your webserver does support SSLv2, then you would receive an output with the certificate key and lot of other information.

In the next post, I will demonstrate how to disable SSLv2 and other vulnerable protocols.

Fix SSL Vulnerability Part 1 of 3: SSL and TLS introduction

Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are required for secure data communication over the internet. TLS and SSL encrypt the network communication using various parameters that are decided during the initial client-server handshake. These protocols help to prevent eavesdropping and to securely identify the web server with which the connection is being made thereby making your data transactions over the internet (such as bank account access, online purchase at amazon.com, e-bay.com or other such sites, donations to an organization using credit card/bank account, household utility account access, etc) more secure.