2

Thanks in advance for reading. I'm using Win Server 2012 R2 to dish out group policies.

I've created a GPO to define the SSL Cipher Suite Order under Policies > Admin Templates > Network > SSL Confugration Settings and have set it to "Enabled".

I'm using a list of strong cipher suites from Steve Gibsons website found here.

I've put them all on 1 long line as it states to do.

I've also manipulated a default registry value located at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\Default\00010002 

These are the same values I'm using from Gibsons site - on separate lines with no commas

My registry values change but I cannot get the SSL Configuration settings to display "Enabled"

Does anyone have insight on how to correct this issue?

1

Are you setting both the policy value AND the registry?

My understanding from here is that you can't do both:

The Microsoft SCHANNEL team does not support directly manipulating the Group Policy and Default Cipher suite locations in the registry.

4
  • 2
    I was manipulating both. I have since stopped manipulating the registry and only manipulate the Cipher Suite Order using the SSL Configuration Settings through a GPO. I verified using gpresult that it's getting the GPO. I have also scanned the server to make sure it really was applied. I started a thread at microsoft: link ... and this is a setting that on the client will not show "enabled" – ChuTang Nov 30 '17 at 19:20
  • Fwiw, I asked the guy in charge of that setting in my environment and he said that it was definitely enabled, even if the UI wasn't showing that it was. I don't know how to verify that. From what I can tell, he was entering the string for that setting directly into the registry. My -guess- is that if you enable it, then set it by hand in the reg, that the UI doesn't know that it's NOT actually enabled until you change it in the UI. But that's my conjecture. I also saw questions on the MS forums without resolved answer. – dethSwatch Dec 1 '17 at 16:22
  • 1
    You can verify GPO settings by running this command as administrator: Gpresult /h result.html ... then view that file and it will show all GPOs applied -- that is how i verified it's getting my cipher suite order gpo. After I applied the GPO, rebooted server, ran SSL Test against the server, and verified the old cipher suites were no longer being used. – ChuTang Dec 4 '17 at 12:42
  • If you're working with a site that's available externally (i.e. to the internet; rather than just within your company network), tools such as Mozilla Observatory can be used to check what ciphers are enabled: observatory.mozilla.org/analyze/yoursite.yourdomain.com#tls – JohnLBevan Jan 8 '19 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.