TLS-SSL-Protocols: Difference between revisions

From Moonlight Design
Jump to navigation Jump to search
(Initial page)
(No difference)

Revision as of 16:28, 18 October 2014

As a way to mitigate the Padding Oracle on Legacy Encryption (POODLE) attack, information technology (IT) administrators can disable all protocols older than TLSv1 via ActiveDirectory group policies. This page describes how to do this.

Using the Windows Server 2003 compatible administrative template with the group policy editor allows IT administrators to deploy computer-level policies that disable legacy protocols within Windows Schannel and deploy user-level policies that disable legacy protocols within Internet Explorer. Note that a computer-level disable policy for a protocol overrides Internet Explorer's configuration for that protocol.

Installation

Save the Windows Server 2003 compatible administrative template as TLS-SSL-Protocols.adm within your Windows INF folder. This is typically C:\Windows\INF.

Include in a Policy

This administrative template includes two group policy targets: Computer and User.

Computer Policies

The Computer policies configure the Windows Schannel protocol support, which impacts client software and server software with dedicated settings for each. Internet Explorer, email software, and any program that connects to the local network or Internet and uses Windows Schannel for securing its connections are affected by the client policies. Internet Information Server, .NET server software, and any program that listens for and accepts secure connections from the local network or Internet and uses Windows Schannel for securing connections are affected by the server policies.

Mozilla Firefox, Google Chrome, and Java, however, use their own software for securing connections and aren't affected by the client policies. Similarly, Java and software that uses OpenSSL (Apache, etc) or other non-Schannel software aren't affected by the server policies.