Hi,
Thank you for the post.
In order to get IIS7 to do 256 bit encryption, we have to ensure the cipher suit that is listed first is the following: TLS_RSA_WITH_AES_256_CBC_SHA
In order to change the Cipher Suite order we can do the following:
- Run gpedit.msc from the command line
- within the Group Policy Object Editor, expand Computer Configuration, Administrative Templates, Network.
- Under Network, select SSL Configuration and then double click on SSL Cipher Suite Order
- By Default the SSL Cipher Suite Order is set to "Not Configured"
- To enable 256-bit encryption, select the "enabled" radio button
- Within the SSL Cipher Suites text box, remove TLS_RSA_WITH_AES_128_CBC_SHA or at least place it behind TLS_RSA_WITH_AES_256_CBC_SHA.
TLS_RSA_WITH_AES_256_CBC_SHA has to be the first cpiher suite listed in order for us to connect with 256-bith encryption.
Once the steps above have been completed, restart the server for the changes to take effect. Now we can browse a page served on the IIS7 server and confirm it is using
256 bit encryption. To do this, right click on the page, select properties and you should see the following:
TLS 1.0, AES with 256 bit encryption (High); RSA with 1024 bit exchange
Regards,
Nick Gu - MSFT
