Enhancing SSL Security - Revision history

Ltalaschus at 14:04, 22 August 2023

2023-08-22T14:04:31Z

Bmeyn: /* Recommended Settings */

2022-05-30T12:28:37Z

Recommended Settings

Ltalaschus at 13:49, 30 August 2019

2019-08-30T13:49:16Z

Ltalaschus at 13:46, 30 August 2019

2019-08-30T13:46:50Z

Dweuthen: /* Recommended Settings */

2018-07-16T09:01:21Z

Recommended Settings

Dweuthen: Updated to represent current state of security

2018-07-16T09:00:53Z

Updated to represent current state of security

Dweuthen: /* Recommended Settings */

2016-06-27T13:45:09Z

Recommended Settings

Dweuthen: /* Recommended Settings */

2014-11-10T13:35:43Z

Recommended Settings

Admin at 13:25, 30 October 2014

2014-10-30T13:25:28Z

Dweuthen at 17:09, 28 October 2014

2014-10-28T17:09:54Z

@@ Line 8: / Line 8: @@
 == Recommended Settings ==
-Highest level of security can be achieved with the following settings in ''IIS Crypto'' on the MailStore Server computer.
+Highest level of security can be achieved with the following settings in ''IIS Crypto'' on the MailStore Server computer. Some options are only available on Windows Server 2022 and Windows 11.
 {| class="wikitable"
 | '''Protocols Enabled'''
-| TLS 1.2
+| TLS 1.3<br/>
 |-
 | '''Ciphers Enabled'''
@@ Line 30: / Line 31: @@
 |-
 | '''SSL Cipher Suite Order'''
-| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384<br/>
+| TLS_AES_256_GCM_SHA384<br/>
 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256<br/>
 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384<br/>

@@ Line 12: / Line 12: @@
 {| class="wikitable"
 | '''Protocols Enabled'''
-| TLS 1.1<br/>
+| TLS 1.2
 |-
 | '''Ciphers Enabled'''

@@ Line 3: / Line 3: @@
 Therefore enhancing the security of SSL mainly consists of disabling these insecure protocols, ciphers and hashes as well as prioritize cipher suites that allow the usage of [[wikipedia:Perfect Forward Secrecy|Perfect Forward Secrecy]].
-As MailStore Server relies on Windows' security support provider (SSP) called ''Secure Channel'' (also known as ''Schannel''), a number of registry keys have to be created or modified in order to disable insecure protocols, ciphers and hashes. Although Microsoft's Technet article [https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings Transport Layer Security (TLS) registry settings] describes in detail which registry keys affect the security provider settings, it is not recommended to manually change these keys. A safer way to adjust the ''Schannel'' settings for server applications is [https://www.nartac.com/ Nartac Software's IIS Crypto] tool.
+As MailStore Server relies on Windows' security support provider (SSP) called ''Secure Channel'' (also known as ''Schannel''), a number of registry keys have to be created or modified in order to disable insecure protocols, ciphers and hashes. Although Microsoft's article [https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings Transport Layer Security (TLS) registry settings] describes in detail which registry keys affect the security provider settings, it is not recommended to manually change these keys. A safer way to adjust the ''Schannel'' settings for server applications is [https://www.nartac.com/ Nartac Software's IIS Crypto] tool.
 <p class="mswarning">'''Important note: ''' Modifying the configuration of the security support provider (SSP) in Windows may affect general operating system functions such as authentication services and remote desktop and management capabilities or other third party applications that rely on SSP. Thus careful testing of all services is required after applying the changes. </p>

@@ Line 3: / Line 3: @@
 Therefore enhancing the security of SSL mainly consists of disabling these insecure protocols, ciphers and hashes as well as prioritize cipher suites that allow the usage of [[wikipedia:Perfect Forward Secrecy|Perfect Forward Secrecy]].
-As MailStore Server relies on Windows' security support provider (SSP) called ''Secure Channel'' (also known as ''Schannel''), a number of registry keys have to be created or modified in order to disable insecure protocols, ciphers and hashes. Although Microsoft's Technet article [http://support.microsoft.com/kb/245030 How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll] describes in detail which registry keys affect the security provider settings, it is not recommended to manually change these keys. A safer way to adjust the ''Schannel'' settings for server applications is [https://www.nartac.com/ Nartac Software's IIS Crypto] tool.
+As MailStore Server relies on Windows' security support provider (SSP) called ''Secure Channel'' (also known as ''Schannel''), a number of registry keys have to be created or modified in order to disable insecure protocols, ciphers and hashes. Although Microsoft's Technet article [https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings Transport Layer Security (TLS) registry settings] describes in detail which registry keys affect the security provider settings, it is not recommended to manually change these keys. A safer way to adjust the ''Schannel'' settings for server applications is [https://www.nartac.com/ Nartac Software's IIS Crypto] tool.
 <p class="mswarning">'''Important note: ''' Modifying the configuration of the security support provider (SSP) in Windows may affect general operating system functions such as authentication services and remote desktop and management capabilities or other third party applications that rely on SSP. Thus careful testing of all services is required after applying the changes. </p>

@@ Line 33: / Line 33: @@
 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384<br/>
 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256<br/>
 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA<br/>
 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384<br/>
 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256<br/>

@@ Line 12: / Line 12: @@
 {| class="wikitable"
 | '''Protocols Enabled'''
-| TLS 1.0<br/>TLS 1.1<br/>TLS 1.2
+| TLS 1.1<br/>
 |-
 | '''Ciphers Enabled'''
-| AES 128/128<br/>AES 256/256
+| AES 128/128<br/>
 |-
 | '''Hashes Enabled'''
@@ Line 29: / Line 31: @@
 |-
 | '''SSL Cipher Suite Order'''
-| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521<br/>
+| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384<br/>
-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384<br/>
+TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256<br/>
-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256<br/>
+TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA<br/>
-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521<br/>
+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA<br/>
-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384<br/>
+TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384<br/>
-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256<br/>
+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521<br/>
+TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384<br/>
+TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256<br/>
+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521<br/>
+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384<br/>
+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256<br/>
+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA<br/>
 |}
 [[de:SSL-Sicherheit verbessern]]
 [[en:Enhancing SSL Security]]

@@ Line 20: / Line 20: @@
 |-
 | '''Hashes Enabled'''
-| SHA
+| SHA<br/>
 |-
 | '''Key Exchange Enabled'''
-| Diffie-Hellman<br/>PKCS
+| Diffie-Hellman<br/>
 |-
 | '''SSL Cipher Suite Order'''
@@ Line 33: / Line 38: @@
 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256<br/>
-TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521<br/>
+TLS_RSA_WITH_AES_256_GCM_SHA384*<br/>
-TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384<br/>
+TLS_RSA_WITH_AES_128_GCM_SHA256*<br/>
 TLS_RSA_WITH_AES_256_CBC_SHA256<br/>
 TLS_RSA_WITH_AES_256_CBC_SHA<br/>
 TLS_RSA_WITH_AES_128_CBC_SHA256<br/>
 TLS_RSA_WITH_AES_128_CBC_SHA<br/>
 |}
 [[de:SSL-Sicherheit verbessern]]
 [[en:Enhancing SSL Security]]

@@ Line 1: / Line 1: @@
 The default configuration of most operating systems allow any set of supported ciphers and hashes to be used by applications when acting as SSL client or server. While this ensures full compatibility with other client and server applications, it does no longer match the expectation in SSL encrypted communication in regards to privacy and trust due to supporting insecure protocols, cipher suites and hash algorithms.
-Thus enhancing the security of SSL mainly consists of disabling these insecure protocols, ciphers and hashes as well as prioritize cipher suites that allow the usage of [[wikipedia:Perfect Forward Secrecy|Perfect Forward Secrecy]].
+Therefore enhancing the security of SSL mainly consists of disabling these insecure protocols, ciphers and hashes as well as prioritize cipher suites that allow the usage of [[wikipedia:Perfect Forward Secrecy|Perfect Forward Secrecy]].
 As MailStore Server relies on Windows' security support provider (SSP) called ''Secure Channel'' (also known as ''Schannel''), a number of registry keys have to be created or modified in order to disable insecure protocols, ciphers and hashes. Although Microsoft's Technet article [http://support.microsoft.com/kb/245030 How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll] describes in detail which registry keys affect the security provider settings, it is not recommended to manually change these keys. A safer way to adjust the ''Schannel'' settings for server applications is [https://www.nartac.com/ Nartac Software's IIS Crypto] tool.

@@ Line 10: / Line 10: @@
 Highest level of security can be achieved with the following settings in ''IIS Crypto'' on the MailStore Server computer.
-<p class="msnote">'''Please notice:''' The recommended settings will prevent Windows XP clients from connecting to MailStore Server. If supporting Windows XP clients is mandatory, use the ''Best Practice'' template of ''IIS Crypto'' which re-enables the weaker ''SSL 3.0'' protocol as well as the ''Triple DES 168/168'' and ''RC4 128/128'' ciphers and ''MD5'' hashes.</p>
+<p class="msnote">'''Please notice:''' The recommended settings will prevent Windows XP clients from connecting to MailStore Server. If supporting Windows XP clients is mandatory, use the ''Best Practice'' template of ''IIS Crypto'' which re-enables the insecure ''SSL 3.0'' protocol as well as the weaker ''Triple DES 168/168'' and ''RC4 128/128'' ciphers and ''MD5'' hashes.</p>
 {| class="wikitable"