My-Network.INFO

How can I disable SSL version 2 in Apache and IIS?

When we speak of SSL we usually refer to versions 2 and 3, and to the TLS 1.0, which is commonly accepted to be SSL v3.1. However, we now know that version 2 is not very secure. Unless you have really old clients that you must support (and they don’t understand SSLv3 or better) you can safely disable SSL v2.

To disable SSL v2 in Apache, add the following line to your httpd.conf file:

SSLProtocol All -SSLv2

To disable SSL v2 in IIS, we will need to modify the registry.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. We cannot guarantee that these problems can be solved. Modify the registry at your own risk.

1. Click Start, click Run, type regedt32, and then click OK.
2. In Registry Editor, locate the following registry key:
HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
3. On the Edit menu, click New.
4. Click DWORD value.
5. Type Enabled for the name
6. Double click on this entry.
7. For Value data, type 00000000 (Decmial) to set the value of the new key equal to “0”.
8. Click OK.
9. Restart the computer.

Ad Space