A vulnerability in SSL 3.0 could allow information disclosure. The fix is to turn off SSL 3.0 and use TLS instead. Here are two ways to do that on Windows clients: centrally with Group Policy, or per machine in Internet Explorer. To disable SSL 3.0 on the server side, see how to disable SSL 3.0 on Microsoft IIS.
Option 1: Disable SSL 3.0 with Group Policy
Use the Turn off Encryption Support setting to disable SSL 3.0 and enable TLS 1.0, TLS 1.1 and TLS 1.2 across the domain.
- Open Group Policy Management.
- Right-click the Group Policy Object to modify and select Edit.
- In the Group Policy Management Editor, browse to Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Explorer Control Panel > Advanced Page > Turn off Encryption Support.
- Double-click Turn off Encryption Support and click Enabled.
- In the Options pane, set Secure Protocol combinations to Use TLS 1.0, TLS 1.1, and TLS 1.2.
- Click OK.
Option 2: Disable SSL 3.0 in Internet Explorer
To change the protocol versions Internet Explorer uses for HTTPS on a single computer:
- On the Internet Explorer Tools menu, click Internet Options.
- Click the Advanced tab.
- In the Security category, uncheck Use SSL 3.0 and check Use TLS 1.0, Use TLS 1.1 and Use TLS 1.2 (if available).
- Click OK, then exit and restart Internet Explorer.
Want to check whether a server still accepts SSLv3? Here’s a quick way to test for SSLv3.