Enhancing SSL Security - Revision history

Ltalaschus at 14:13, 22 August 2023

2023-08-22T14:13:55Z

Bmeyn at 12:55, 22 June 2022

2022-06-22T12:55:44Z

Ltalaschus at 13:49, 30 August 2019

2019-08-30T13:49:58Z

Dweuthen at 09:39, 16 July 2018

2018-07-16T09:39:15Z

Dweuthen: /* Recommended Settings */

2016-06-27T13:41:59Z

Recommended Settings

Dweuthen: /* Recommended Settings */

2014-11-10T13:34:58Z

Recommended Settings

Dweuthen: /* Recommended Settings */

2014-11-10T12:58:47Z

Recommended Settings

Dweuthen at 17:16, 28 October 2014

2014-10-28T17:16:50Z

Dweuthen at 16:28, 28 October 2014

2014-10-28T16:28:09Z

Dweuthen at 16:27, 28 October 2014

2014-10-28T16:27:33Z

@@ Line 6: / Line 6: @@
 == Recommended Settings ==
-Highest level of security can be achieved with the following settings in ''IIS Crypto''. In a multi-server setup of MailStore SPE, the changes should be applied to all servers with Management Server or Client Access Server role.
+Highest level of security can be achieved with the following settings in ''IIS Crypto''. In a multi-server setup of MailStore SPE, the changes should be applied to all servers with Management Server or Client Access Server role. Some options are only available on Windows Server 2022 and Windows 11.
 {| class="wikitable"
 | '''Protocols Enabled'''
-| TLS 1.2
+| TLS 1.3<br/>
 |-
 | '''Ciphers Enabled'''
@@ Line 28: / Line 29: @@
 |-
 | '''SSL Cipher Suite Order'''
-| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384<br/>
+| TLS_AES_256_GCM_SHA384<br/>
 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256<br/>
 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384<br/>

@@ Line 10: / Line 10: @@
 {| class="wikitable"
 | '''Protocols Enabled'''
-| TLS 1.1<br/>
+| TLS 1.2
 |-
 | '''Ciphers Enabled'''

@@ Line 3: / Line 3: @@
 Thus enhancing the security of SSL mainly consists of disabling these insecure protocols, ciphers and hashes as well as prioritize cipher suites that allow the usage of [[wikipedia:Perfect Forward Secrecy|Perfect Forward Secrecy]].
-As all components of the MailStore Service Provider Edition rely on Windows' security support provider (SSP) called ''Secure Channel'' (also known as ''Schannel''), a number of registry keys have to be created or modified in order to disable insecure protocols, ciphers and hashes. Although Microsoft's Technet article [http://support.microsoft.com/kb/245030 How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll] describes in detail which registry keys affect the security provider settings, it is not recommended to manually change these keys. A safer way to adjust the ''Schannel'' settings for server applications is [https://www.nartac.com/ Nartac Software's IIS Crypto] tool.
+As all components of the MailStore Service Provider Edition rely on Windows' security support provider (SSP) called ''Secure Channel'' (also known as ''Schannel''), a number of registry keys have to be created or modified in order to disable insecure protocols, ciphers and hashes. Although Microsoft's article [https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings Transport Layer Security (TLS) registry settings] describes in detail which registry keys affect the security provider settings, it is not recommended to manually change these keys. A safer way to adjust the ''Schannel'' settings for server applications is [https://www.nartac.com/ Nartac Software's IIS Crypto] tool.
 == Recommended Settings ==

@@ Line 10: / Line 10: @@
 {| class="wikitable"
 | '''Protocols Enabled'''
-| TLS 1.0<br/>TLS 1.1<br/>TLS 1.2
+| TLS 1.1<br/>
 |-
 | '''Ciphers Enabled'''
-| AES 128/128<br/>AES 256/256
+| AES 128/128<br/>
 |-
 | '''Hashes Enabled'''
@@ Line 27: / Line 29: @@
 |-
 | '''SSL Cipher Suite Order'''
-| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521<br/>
+| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384<br/>
-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384<br/>
+TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256<br/>
-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256<br/>
+TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384<br/>
-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521<br/>
+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256<br/>
-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384<br/>
+TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA<br/>
-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256<br/>
+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521<br/>
+TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384<br/>
+TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256<br/>
+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521<br/>
+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384<br/>
+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA<br/>
-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256<br/>
+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA<br/>
 |}

@@ Line 7: / Line 7: @@
 == Recommended Settings ==
 Highest level of security can be achieved with the following settings in ''IIS Crypto''. In a multi-server setup of MailStore SPE, the changes should be applied to all servers with Management Server or Client Access Server role.
 {| class="wikitable"

@@ Line 18: / Line 18: @@
 |-
 | '''Hashes Enabled'''
-| SHA
+| SHA<br/>
 |-
 | '''Key Exchange Enabled'''
-| Diffie-Hellman<br/>PKCS
+| Diffie-Hellman<br/>
 |-
 | '''SSL Cipher Suite Order'''

@@ Line 31: / Line 31: @@
 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384<br/>
 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256<br/>
-TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521<br/>
+TLS_RSA_WITH_AES_256_GCM_SHA384*<br/>
-TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384<br/>
+TLS_RSA_WITH_AES_128_GCM_SHA256*<br/>
 TLS_RSA_WITH_AES_256_CBC_SHA256<br/>
 TLS_RSA_WITH_AES_256_CBC_SHA<br/>
 TLS_RSA_WITH_AES_128_CBC_SHA256<br/>
 TLS_RSA_WITH_AES_128_CBC_SHA<br/>
 |}

@@ Line 8: / Line 8: @@
 Highest level of security can be achieved with the following settings in ''IIS Crypto''. In a multi-server setup of MailStore SPE, the changes should be applied to all servers with Management Server or Client Access Server role.
-<p class="msnote">'''Please notice:''' The recommended settings will prevent Windows XP clients from connecting to MailStore SPE. If supporting Windows XP clients is mandatory, use the ''Best Practice'' template of ''IIS Crypto'' which re-enables the weaker ''SSL 3.0'' protocol as well as the ''Triple DES 168/168'' and ''RC4 128/128'' ciphers and ''MD5'' hashes.</p>
+<p class="msnote">'''Please notice:''' The recommended settings will prevent Windows XP clients from connecting to MailStore SPE. If supporting Windows XP clients is mandatory, use the ''Best Practice'' template of ''IIS Crypto'' which re-enables the insecure ''SSL 3.0'' protocol as well as the waeker ''Triple DES 168/168'' and ''RC4 128/128'' ciphers and ''MD5'' hashes.</p>
 {| class="wikitable"