After testing IIS Crypto 2.0 we ran into an issue with soon to be released Windows Server 2016. All of the Qualys SSL scans were not recognizing the order of the cipher suites configured by IIS Crypto. It turns out that Microsoft quietly renamed most of their cipher suites dropping the curve (_P521, _P384, _P256) from them. This reduced most suites from three down to one. However, this threw us a bit of a curve ball as now IIS Crypto’s configuration and all of the templates needed to support OS version checking. We added this in one of the beta versions, retested and sure enough the scans were now showing the correct cipher suite order.
While testing the latest version of IIS Crypto, we researched all of the cipher suites for each operating system. Unfortunately there is little up-to-date documentation on the default cipher suites included or their order for TLS negotiation. We ended up extracting the list by logging into every fully patched version of Windows Server and exporting the proper registry key values. The full list can be found here.
We are happy to announce that IIS Crypto 2.0 has been released! This new version is a complete rewrite and has a brand new interface. Some new features include creating custom templates, Windows Server 2016 support, add your own cipher suites, check for updates and much more. The full change log can be found on our download page. We have also updated the documentation and FAQ.
Thank-you everyone for all of your comments and feedback!
A new SSL/TLS vulnerabilty was recently discovered dubbed “FREAK“. Originally it was thought that only OpenSSL was vulnerable, however, Microsoft just issued an advisory (3046015) describing the affected versions of Windows. The default configuration of Windows 2003 is vulnerable, however, Windows 2008 and above are not affected in the default configuration. The Best Practices template in IIS Crypto solves this by removing the affected cipher suites.
Microsoft has just released an update for MS14-066. All this update does is remove TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256 from the default cipher suite list for Windows 2008 R2 and Windows 2012. It does not update Windows 2012 R2. This seems like a temporary measure until Microsoft figures out what the real issue is. In the mean time, make sure that those cipher suites are unchecked in IIS Crypto.
Nartac Software 