Problem in disabling SSL2 and SSL 3 along with TLS 1.0.

[Chaitanyakrishna20]

"Hi experts , we have an AD server windows server 2016 with a vulnerability - SSL Version 2 and 3 Protocol Detection " i have disabled SSL2 and SSL 3 along with TLS 1.0 ,

Windows Registry Editor Version 5.00


; Disable SSL 2.0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

; Disable SSL 3.0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000

and similarly entry for TLS1.0 and i have restarted the server but the server is still vulnerable. can you suggest me will disabling week ciphers effect any AD functionality
weak ciphers DES-CBC(40) RC4(40) and DES-CBC(56) , 3DES-CBC(168

if disabling them wont cause issue, then can you suggest the registry for them.

Below is the details of vulnerability i am getting,


Plugin Output:
- SSLv3 is enabled and the server supports at least one cipher.
Explanation: TLS 1.0 and SSL 3.0 cipher suites may be used with SSLv3


Low Strength Ciphers (<= 64-bit key)

EXP-ADH-DES-CBC-SHA Kx=DH(512) Au=None Enc=DES-CBC(40) Mac=SHA1 export
EXP-ADH-RC4-MD5 Kx=DH(512) Au=None Enc=RC4(40) Mac=MD5 export
ADH-DES-CBC-SHA Kx=DH Au=None Enc=DES-CBC(56) Mac=SHA1

Medium Strength Ciphers (> 64-bit and < 112-bit key, or 3DES)

ADH-DES-CBC3-SHA Kx=DH Au=None Enc=3DES-CBC(168) Mac=SHA1

High Strength Ciphers (>= 112-bit key)

ADH-AES128-SHA Kx=DH Au=None Enc=AES-CBC(128) Mac=SHA1
ADH-AES256-SHA Kx=DH Au=None Enc=AES-CBC(256) Mac=SHA1
ADH-CAMELLIA128-SHA Kx=DH Au=None Enc=Camellia-CBC(128) Mac=SHA1
ADH-CAMELLIA256-SHA Kx=DH Au=None Enc=Camellia-CBC(256) Mac=SHA1
ADH-RC4-MD5 Kx=DH Au=None Enc=RC4(128) Mac=MD5
ADH-SEED-SHA Kx=DH Au=None Enc=SEED-CBC(128) Mac=SHA1

The fields above are :

{OpenSSL ciphername}
Kx={key exchange}
Au={authentication}
Enc={symmetric encryption method}
Mac={message authentication code}
{export flag}

Continue reading...