Ciphers vs IISCrypto?

Question

Hello,

I am about to replace Microsoft Internet Explorer by Microsoft Edge I have an issue:

This is what I am seeing in IE: (OS: Windows Server 2016)

How should I translate it in IISCrypto:

Thanks,
Dom

Answer 1

I'm not sure that I can help you but since no one else has replied.... Are those images from the client or the web server? Are both servers configured to support the same protocols/ciphers?

Have you seen this page?

https://www.tecklyfe.com/how-to-fix-ns_error_net_inadequate_security-and-err_spdy_inadequate_transport_security-in-iis-on-windows-server-2016/

Answer 2

Hello @Duchemin, Dominique

This error ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY is due to a latter version of Edge, please run Windows Update and install any pending update.

Another option would be to disable HTTPS2 in your server with the next registry key:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters]
“EnableHttp2Tls”=dword:00000000
“EnableHttp2Cleartext”=dword:00000000

Reference: https://learn.microsoft.com/en-us/iis/get-started/whats-new-in-iis-10/http2-on-iis

Hope this helps with your query,

--
--If the reply is helpful, please Upvote and Accept as answer--

Answer 3

Hello Dom,

RFC 7450 (Hypertext Transfer Protocol Version 2 (HTTP/2)) section 9.2.2 suggests that if the server only supports TLS 1.2 (and not TLS 1.3) then TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 will need to be negotiated.

Gary

Answer 4

Hello,

I ran nmap:
Starting Nmap 7.80 ( https://nmap.org ) at 2022-03-01 11:14 Pacific Standard Time
Nmap scan report for VRPSCCMDP01 (xxx.xxx.xxx.xxx)
Host is up (0.0020s latency).
rDNS record for xxx.xxx.xxx.xxx: yyyyyyyy.ad

PORT STATE SERVICE VERSION
443/tcp open ssl/https
|_http-server-header: Microsoft-IIS/10.0
| ssl-enum-ciphers:
| TLSv1.0:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp521r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp521r1) - A
| compressors:
| NULL
| cipher preference: server
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp521r1) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp521r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp521r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp521r1) - A
| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp521r1) - A
| compressors:
| NULL
| cipher preference: server
|_ least strength: A

Which one is missing to allow the web site?

Thanks,
Dom

Answer 5

Thanks MotoX80...

The screenshots are from the Web Server.
I was trying to test the ciphers one-by-one and after reading your post I think I was changing the Client Ciphers and browsing the web server which does not make sense.... as this web server was never changed!!!

I will review this.
Still trying to identify the ciphers needed...

Thanks for catching this.
Dom