PCI Compliance - Disabling Week and Medium Strength Ciphers in IIS
I was working on PCI compliance a while back for a client. SecurityMetrics.com was running a scan on the machine where their website was hosted and coming back with this error:
Synopsis : The remote service supports the use of weak SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all
and also this one
Synopsis : The remote service supports the use of medium strength SSL ciphers. Description : The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.
The solution involves making a change to the Registry. Open the Registry Editior (Start -> Run -> type Regedit).
Navigate to the following registry path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\
Protocols\SSL2.0\Server\
Add a new DWord Value named Enabled which and set it to 0.