IIS SSL

README.md

IIS SSL Diffie-Hellman

https://www.ssllabs.com/ssltest/analyze.html

• Remove SSLv3 support
• Remove RC4 cypher support
• enforce 2048-bit keys (Diffie-Hellman)

See the enclosed reg file.

Notes

• https://msdn.microsoft.com/en-us/library/windows/desktop/aa374757%28v=vs.85%29.aspx?f=255
• https://technet.microsoft.com/library/security/3174644?f=255
• https://weakdh.org/
• https://weakdh.org/sysadmin.html
• https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

Upgrade_IIS_SSL_Key_Exchange.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
"ServerMinKeyBitLength"=dword:00000800

; Following taken from https://samrueby.com/2015/06/08/how-to-disable-sslv3-and-rc4-ciphers-in-iis/

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
"DisabledByDefault"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000