IIS Crypto 1.6 Released with Updates for MS14-066

IIS Crypto 1.6 has been released. This version adds the 4 additional cipher suites that were updated as part of the MS14-066 (KB2992611) patch. Along with some minor fixes, the PCI template now disables SSL 3.0 and RC4. Full version history can be found here.

Microsoft released a patch named MS14-066 on November 11, 2014 to address a vulnerability in SChannel that could allow remote code execution. The patch includes 4 new cipher suites for Windows Server versions 2003 through 2012 R2. Previously only Windows Server 2012 R2 had these cipher suites. On November 16, Microsoft updated the advisory stating that they found an issue with the new cipher suites they introduced. If you have applied this patch and are running into connection issues with clients, the work around is to disable the following cipher suites: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384 and TLS_RSA_WITH_AES_128_GCM_SHA256. Using IIS Crypto simply uncheck these cipher suites, click Apply and reboot your server.