Groups | Blog | Home
all groups > iis security > april 2007 >

iis security : Notify user of SSL 3 requirement


cats solutions
4/25/2007 3:54:02 AM
We have enforced SSL v3.0 or TLS v1.0 on our server (Win 2003 Srv R2 with IIS
6). When I try to connect using only SSl v2.0 I just get a Page Cannot Be
Displayed error message.

What I want to do is this:

I want the user to connect an unsecured page which runs a script to see if
the client has SSL v3 or TLS v1 enabled and if so forward them to the secured
page. If they can not use SSL v3 or TLS v1 then they are given a custom
error message.

Roger Abell [MVP]
4/27/2007 11:19:46 PM
[quoted text, click to view]

I guess I am missing something here.
If you have an error handler page for 403.4 and they land
there would that not be because either
a) the original page was set to require https and they used http
or
b) they used https but could not actually use it (i.e. no SSL 3 or TLS 1)
??
So, if your original page is not configured in IIS to require https, but
instead does a serverside test if the server var HTTPS is ON and if
not redirects to itself with https:// then would not the only reason
they would land at the errror handler page be because they could
not support SSL 3 or TSL 1 ??

Daniel Crichton
5/3/2007 5:08:00 PM
Roger wrote on Fri, 27 Apr 2007 23:19:46 -0700:

[quoted text, click to view]

How would it be possible for the browser to hit the error handler page when
it cannot make a connection to the server in the first place? If the browser
only supports SSL2, and the server doesn't, then it's not possible for the
browser to connect during the SSL handshaking stage so will never see any
response from the server.

In case (a) it works because the connection to the server doesn't use SSL.
For (b) it'll never work.

Dan

AddThis Social Bookmark Button