How to Disable Weak SSL Ciphers

A network is only as secure as its server.

Microsoft Internet Information Server, or IIS, uses a secure HTTP connection for remote access to the server. When a secure connection is used, the server attempts to communicate in three different protocols. It first tries the PCT 1.0 protocol, before trying SSL 3.0 and SSL 2.0. The problem with this is that PCT 1.0 has weak ciphers, or encrypted communications. This makes it an immediate security risk and needs to be disabled. The SSL 3.0 protocol can be forced via the server's registry using a settings import file called a .REG file.

Instructions

Back up the Windows Registry

1. Turn on your server and log in. Press "WIN" and "R" at the same time. "WIN" is the Windows logo key located next to the "Ctrl" key.

2. Type "regedit" into the Run dialog box and press "Enter." Click on the "+" to the left of the "HKEY_LOCAL_MACHINE" item and expand each folder in the left pane to the following path: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL."

3. Highlight the SCHANNEL folder in the left pane. Select "File" from the menu bar and click "Export." Save the registry file to somewhere secure, such as the system drive.

Disable the Weak SSL Ciphers

1. Open the folder where you saved the .REG file. Right-click the .REG file and select "Edit." Highlight everything and press the "Delete" key.

2. Copy and paste the following into the .REG file:

   Windows Registry Editor Version 5.00

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]

   "Enabled"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]

   "Enabled"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]

   "Enabled"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128]

   "Enabled"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]

   "Enabled"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]

   "Enabled"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128]

   "Enabled"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]

   "Enabled"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]

   "Enabled"=dword:00000000

3. Click on "File" and select "Save As." Name the file "Disable Ciphers.REG" and save it in the same folder as the original .REG file.

4. Open the folder the .REG files are saved in and double-click the Disable Ciphers.REG file. Confirm the registry addition box by selecting "Yes."

5. Confirm that everything still functions properly. Log out if the server is running properly. Use the original .REG file to restore the old registry settings if disabling the ciphers causes other issues.

Tips & Warnings

• Always perform a backup of the registry before editing it.

• Do not deviate from the registry settings provided, or your system may be damaged.

References

• Microsoft: How to Disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services
• Braindump: Windows/IIS SSL --- Restrict Weak Ciphers
• Blogging Techstacks: IIS --- Disabling SSLv2 and Weak Ciphers
• CP: Registry Hack .Reg Files for Windows Machines