IIS / SMTP – 禁用SSLv2

我正试图在我们的IIS / SMTP服务器上禁用SSL2。我们正在使用Windows Server 2008 R2 Enterprise（64位）。我们使用IIS6pipe理器来pipe理SMTP虚拟服务器。我尝试了很多方法，但都没有成功。每次更改后我都完全重新启动。

我正在使用以下命令从另一台服务器进行testing，但仍显示通过SSL2连接：

$ openssl s_client -debug -connect servername:25 -ssl2 CONNECTED(00000003) write to 0x600078840 [0x600181951] (45 bytes => 45 (0x2D)) 0000 - 80 2b 01 00 02 00 12 00-00 00 10 03 00 80 01 00 .+.............. 0010 - 80 07 00 c0 06 00 40 04-00 80 02 00 80 ba 66 21 [email protected]! 0020 - fe 2d 4c 49 44 b9 23 e5-f9 10 a5 21 7f .-LID.#....!. read from 0x600078840 [0x600070790] (2 bytes => 2 (0x2)) 0000 - 32 32 22 read from 0x600078840 [0x600070792] (12851 bytes => 123 (0x7B)) 0000 - 30 20 6d 61 69 6c 2e 65-67 32 2e 66 69 65 6c 64 0 mail.ourdomain 0010 - 67 6c 61 73 73 2e 6e 65-74 20 4d 69 63 72 6f 73 name.net Micros 0020 - 6f 66 74 20 45 53 4d 54-50 20 4d 41 49 4c 20 53 oft ESMTP MAIL S 0030 - 65 72 76 69 63 65 2c 20-56 65 72 73 69 6f 6e 3a ervice, Version: 0040 - 20 37 2e 35 2e 37 36 30-31 2e 31 37 35 31 34 20 7.5.7601.17514 0050 - 72 65 61 64 79 20 61 74-20 20 57 65 64 2c 20 38 ready at Wed, 8 0060 - 20 4a 75 6c 20 32 30 31-35 20 31 34 3a 32 36 3a Jul 2015 14:26: 0070 - 31 35 20 2b 30 30 30 30-20 0d 0a 15 +0000 ..

我从微软的build议开始： https ： //support.microsoft.com/en-us/kb/187498

我使用SSL 2.0而不是PCT 1.0：

要禁用PCT 1.0协议，以便IIS不尝试协商使用PCT 1.0协议，请按照下列步骤操作：

单击开始，单击运行，键入regedt32或键入regedit，然后单击确定。在registry编辑器中find以下registry项：HKey_Local_Machine \ System \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Protocols \ PCT 1.0 \ Server

在编辑菜单上，单击添加值。在数据types列表中，单击DWORD。在数值名称框中键入已启用，然后单击确定。

注意如果存在此值，请双击该值以编辑其当前值。在二进制编辑器中键入00000000以将新密钥的值设置为“0”。点击OK。重新启动计算机。

我也试过这个方法： http : //forums.iis.net/t/1151822.aspx?Disable+SSL+v2+in+IIS7+

我什至尝试使用IISencryption，仍然显示为通过SSL2连接。

这里是我几个月前写的一个powershell脚本的摘录，用来完成一大堆与协议支持和密码相关的事情。我专门为Server 2008 R2编写了它。

 # Disable SSL 2.0 (PCI Compliance) md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" -name Enabled -value 0 -PropertyType "DWord"

这只是创build和设置一个registry项，这应该意味着服务器将不再支持传入连接的SSL 2.0。您可以在有问题的服务器上运行此选项以禁用SSL 2.0。

如果你有兴趣，这是完整的脚本。在使用它之前，请检查它与您的scheme的相关程度，因为它会丢弃具有较旧操作系统和浏览器的支持客户端。而且，这些设置是针对Web服务器量身定做的。

 # Enables TLS 1.1 & 1.2 and disbles SSL 2.0 and SSL 3.0 (both as client and server) on Windows Server 2008 R2 and Windows 7. Aditionally it reorders a few cipher suites to prefer stronger ciphers and disables RC4 ciphers. # These keys do not exist so they need to be created prior to setting values. md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" # These keys do not exist so they need to be created prior to setting values. md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" # Enable TLS 1.1 for client and server SCHANNEL communications new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -name "Enabled" -value 1 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" -name "Enabled" -value 1 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" -name "DisabledByDefault" -value 0 -PropertyType "DWord" # Enable TLS 1.2 for client and server SCHANNEL communications new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -name "Enabled" -value 1 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -name "DisabledByDefault" -value 0 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" -name "Enabled" -value 1 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" -name "DisabledByDefault" -value 0 -PropertyType "DWord" # Disable SSL 2.0 (PCI Compliance) md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" -name Enabled -value 0 -PropertyType "DWord" # Disable SSL 3.0 (POODLE) md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server" -name Enabled -value 0 -PropertyType "DWord" # Set preferred cipher suites new-itemproperty -path "HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002" -name Functions -value "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" -PropertyType "String" # These keys do not exist so they need to be created prior to setting values. md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56" md "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128" # Disable RC4 ciphers new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128" -name "Enabled" -value 0 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128" -name "Enabled" -value 0 -PropertyType "DWord" new-itemproperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128" -name "Enabled" -value 0 -PropertyType "DWord"