Our server system is old, but we are not allowed to update the OS.
The OS is Windows Server 2012, SQL Server 2014 is also installed on the server, and we were detected by Qualys to have a vulnerability problem in the system: Weak SSL/TLS Key Exchange, port 1433/tcp over SSL.
We tried to set the "SSL Config Settings" in gpedit.msc, and changed the value to the following, but there is still the vulnerability on port1433.
How should I set the required KEY value? like long enough?
The vulnerability information is as follows:
Weak SSL/TLS Key Exchange， port 1433/tcp over SSL
QID Detection Logic:
For a SSL enabled port, the scanner probes and maintains a list of supported SSL/TLS versions. For each supported version, the scanner does a
SSL handshake to get a list of KEX methods supported by the server. It reports all KEX methods that are considered weak. The criteria of a weak
KEX method is as follows:
The SSL/TLS server supports key exchanges that are cryptographically weaker than recommended. Key exchanges should provide at least 112 bits
of security, which translates to a minimum key size of 2048 bits for Diffie Hellman and RSA key exchanges.
An attacker with access to sufficient computational power might be able to recover the session key and decrypt session content.
Change the SSL/TLS server configuration to only allow strong key exchanges. Key exchanges should provide at least 112 bits of security, which
translates to a minimum key size of 2048 bits for Diffie Hellman and RSA key exchanges.