Score:-1

Disabling SHA in IIS

np flag

My company has a web server running IIS 6, and was asked to help disable SHA on it. Specifically this cipher: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

I found these instructions https://www.namecheap.com/support/knowledgebase/article.aspx/9600/38/disabling-sha1 and set the registry entry for HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA\Enabled to 0, but that immediately stopped access to our website, even without a reboot.

enter image description here

0 and 1 both fail, so ffffffff seems to be the only correct value that will allow us to access the website, but that means that TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA is still enabled.

Is there a better way to do it?

djdomi avatar
za flag
Does this answer your question? [How to configure IIS 7.5 SSL \ TLS to work with iOS 9 ATS](https://serverfault.com/questions/724077/how-to-configure-iis-7-5-ssl-tls-to-work-with-ios-9-ats)
Score:0
mp flag

I would attempt to enable a different encryption method that is "acceptable for your use case"
It might be that certain processes, programs cannot run, or have a dependency on this encryption method. Such as "bit warden", or similar programs.

Score:0
tf flag

It shows some altenate values possible so thought this might help https://www.betaarchive.com/wiki/index.php/Microsoft_KB_Archive/245030

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.