Posted on by harlan

Microsoft IIS: How to Disable SSL 3.0 (POODLE) in the Registry

SSL 3.0 is insecure and should be turned off on any IIS web server. Here’s how to disable it through the registry on Windows Server 2008 R2 or 2012. For background, see the SSL 3.0 information disclosure vulnerability.

Step-by-Step

  1. Open the Registry Editor as administrator: on the Start screen type regedit.exe, right-click it, and click Run as administrator.
  2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
    SCHANNEL Protocols key in the Registry Editor
  3. Right-click Protocols and click New > Key. Name the key SSL 3.0.
    Creating the SSL 3.0 key
  4. Right-click the new SSL 3.0 key, click New > Key, and name it Client.
    Creating the Client key under SSL 3.0
  5. Right-click SSL 3.0 again, click New > Key, and name it Server.
    Creating the Server key under SSL 3.0
  6. Under SSL 3.0, right-click Client, click New > DWORD (32-bit) Value, and name it DisabledByDefault.
    Adding the DisabledByDefault DWORD
  7. Double-click DisabledByDefault, set Value data to 1, and click OK.
    Setting DisabledByDefault to 1
  8. Under SSL 3.0, right-click Server, click New > DWORD (32-bit) Value, and name it Enabled.
    Adding the Enabled DWORD under Server
  9. Double-click Enabled, leave Value data at 0, and click OK.
    Enabled left at 0
  10. Restart the server.

SSL 3.0 is now disabled. To confirm it, see this quick way to test for SSLv3.