Had this pop up on a PCI scan on one of the windows servers I look after with a plesk control panel. The report was moaning about SSLv2 being enabled, below is the actual report

This SSL service supports SSLv2 connections. SSLv2 has known cryptographic weaknesses that can lead to the compromise of data encrypted during the SSL session. Secure web applications should only enable SSLv3, TLSv1, or newer. SSLv3 was released in 1996 with numerous security enhancements over SSLv2. TLSv1 was introduced in 1999 as an enhancement to the security features of SSLv3. All modern browsers have support for both SSLv3 and TLSv1, and often disable support for SSLv2 in the interests of security. The PCI ASV Operational Requirements requires that if SSLv2 is used in the transmission of cardholder data, this must result in a failure. This was clarified in the PCI "Assessor Update: November 2008"

Service: (443) Microsoft-IIS/6.0
Evidence: Cipher: DES-CBC-MD5

This has been tested on a windows 2003 server.

For a quick overview you need to edit the registry and add a couple of “dword” values

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
“Enabled“=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
“Enabled“=dword:00000000

This will disable PCT 1.0 and SSL 2.0 forcing all connections to use SSLv3

This Microsoft article explains in depth on what you need to do if you are nto sure how to edit the registry LINK

Related Posts

  1. PCI Compliance for Plesk (linux)
  2. You may have exceeded the maximum number of connections to this server. (Linux)