Secure Client-Initiated Renegotiation fail

Question

Hi,

 

We've got a problem with the iis webserver on our windows server 2019.

After a penetration test we got the followin error in the testssl check:

  Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), DoS threat

How can I fix this?

 

Thanks a lot,

Istvan

Answer 1

Hello Mile, István,

The "Secure Client-Initiated Renegotiation Vulnerable" issue found during a penetration test indicates a security vulnerability in your IIS web server configuration. Client-initiated renegotiation is a security concern, as it can potentially expose your server to Denial of Service (DoS) attacks.

To fix this vulnerability, you should disable client-initiated renegotiation on your Windows Server 2019 running IIS following this steps:

1. Open Registry Editor (regedit.exe) and navigate to the next path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

2. Create or modify a registry entry called DisableRenegoOnClient as a DWORD value. Set its value to 1 to disable client-initiated renegotiation. If the entry already exists, update its value.
3. Restart the Server

By disabling client-initiated renegotiation, you address the security vulnerability and reduce the risk of DoS attacks associated with this feature. However, be aware that this change might affect compatibility with some older clients that rely on this renegotiation method.

--If the reply is helpful, please Upvote and Accept as answer--