HTTP over SSL removed?

[1etherer]

Hi all,

We patched our web server and since then SSL has been removed from HTTP and I want to know how to enable it again, im guessing its done in IIS? but I dont know much about it and I cant find a guide on it...

So please reply in dummy talk

 

[1etherer]

Ok my colleague fixed the issue, this thread can be closed. Thanks

 

[carnageX]

Mind sharing what was done to fix it in case others have similar issues?

 

[bob442]

Here is a link to a excellent tool for doing just that. nice gui tells you what's enabled and what's not, allows you to change as well.

https://www.nartac.com/Products/IISCrypto/

 

[1etherer]

Nice tool,

I never got back to you carnage, we followed these steps - from the binding step, as we had the cert already, https://www.sslshopper.com/article-installing-an-ssl-certificate-in-windows-server-2008-iis-7.0.html

Then as we only wanted our website to work in SSL, we followed these steps,
https://support.microsoft.com/en-us/kb/324069

A bit late

 

[CntdwnToExtn]

have you also removed SSLv3/TLS1.0/1.1 and using only TLS1.2 on the web server?

 

[1etherer]

have you also removed SSLv3/TLS1.0/1.1 and using only TLS1.2 on the web server?

This is a old thread, I'm not longer at that company. But no I never touched the rest, I just put the cert back on.

If you feel this is another step people should know, please provide the steps or a link would be useful.

 

[CntdwnToExtn]

This is a old thread, I'm not longer at that company. But no I never touched the rest, I just put the cert back on.

If you feel this is another step people should know, please provide the steps or a link would be useful.

bleh, sorry, didn't realize the original post date. I was doing 15 things at the time haha.

ya, no doubt more steps. not sure why Microsoft just doesn't push out an update to force TLS 1.2 as default on IIS. even if the application doesn't support 1.2 it will negotiate down the list and use the best possible. anything below TLS 1.2 shouldn't be used right now. TLS 1.0 is the default in IIS and it can potentially be downgraded to SSLv3, which, can be broken.

i'll post the registry edits tomorrow when i'm at work with suggestions and steps. probably in it's own thread though. lots to talk about that I don't see on here.