-
Notifications
You must be signed in to change notification settings - Fork 22
Description
Recently updated the ciphers(or disabled the old ciphers) on Windows Web Server 2008 R2, as per Vinhold Starbrook's instructions, and after several restarts, the Region consoles are showing, "The client and server cannot communicate, because they do not possess a common algorithm" and crashing. Although that could be because the Halcyon consoles 2-4 are crashing, and subsequently every region that tries to open after that. Though it's not recording any new error in the log.
The UserServer, GridServer, & GridMessagingServer have all been crashing. Apparently because they can't communicate with MySQL for some reason. Though I have the MySQL server and database back up and running now, so it shouldn't have any problem connecting to the database. All of my Osgrid OpenSim regions have no trouble connecting.
APPLICATION EXCEPTION DETECTED: System.UnhandledExceptionEventArgs
Exception: System.ComponentModel.Win32Exception (0x80004005): The client and server cannot communicate, because they do not possess a common algorithm
at System.Net.SSPIWrapper.AcquireCredentialsHandle(SSPIInterface SecModule, String package, CredentialUse intent, SecureCredential scc)
at System.Net.Security.SecureChannel.AcquireCredentialsHandle(CredentialUse credUsage, SecureCredential& secureCredential)
at System.Net.Security.SecureChannel.AcquireClientCredentials(Byte[]& thumbPrint)
at System.Net.Security.SecureChannel.GenerateToken(Byte[] input, Int32 offset, Int32 count, Byte[]& output)
at System.Net.Security.SecureChannel.NextMessage(Byte[] incoming, Int32 offset, Int32 count)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at MySql.Data.MySqlClient.NativeDriver.StartSSL()
at MySql.Data.MySqlClient.NativeDriver.Open()
at MySql.Data.MySqlClient.Driver.Open()
at MySql.Data.MySqlClient.Driver.Create(MySqlConnectionStringBuilder settings)
at MySql.Data.MySqlClient.MySqlPool.GetPooledConnection()
at MySql.Data.MySqlClient.MySqlPool.TryToGetDriver()
at MySql.Data.MySqlClient.MySqlPool.GetConnection()
at MySql.Data.MySqlClient.MySqlConnection.Open()
at OpenSim.Data.SimpleDB.MySQLSimpleDB.OpenConnection() in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\MySQLSimpleDB.cs:line 88
at OpenSim.Data.SimpleDB.MySQLSimpleDB..ctor(String connectionString) in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\MySQLSimpleDB.cs:line 73
at OpenSim.Data.SimpleDB.ConnectionFactory.GetConnection() in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\ConnectionFactory.cs:line 28
at OpenSim.Region.OptionalModules.Avatar.FlexiGroups.NativeGroupDataProvider.GetConnection() in D:\a\halcyon\halcyon\OpenSim\Region\OptionalModules\Avatar\FlexiGroups\NativeGroupDataProvider.cs:line 55
at OpenSim.Region.OptionalModules.Avatar.FlexiGroups.NativeGroupDataProvider..ctor(ConnectionFactory connectionFactory) in D:\a\halcyon\halcyon\OpenSim\Region\OptionalModules\Avatar\FlexiGroups\NativeGroupDataProvider.cs:line 70
at OpenSim.Region.OptionalModules.Avatar.FlexiGroups.ProviderFactory.GetProviderFromConfigName(ILog log, IConfig groupsConfig, String configName) in D:\a\halcyon\halcyon\OpenSim\Region\OptionalModules\Avatar\FlexiGroups\ProviderFactory.cs:line 63
at OpenSim.Region.OptionalModules.Avatar.FlexiGroups.FlexiGroupsModule.Initialize(IConfigSource config) in D:\a\halcyon\halcyon\OpenSim\Region\OptionalModules\Avatar\FlexiGroups\FlexiGroupsModule.cs:line 125
at OpenSim.ApplicationPlugins.RegionModulesController.RegionModulesControllerPlugin.Initialize(OpenSimBase openSim) in D:\a\halcyon\halcyon\OpenSim\ApplicationPlugins\RegionModulesController\RegionModulesControllerPlugin.cs:line 156
at OpenSim.ApplicationPluginInitializer.Initialize(IPlugin plugin) in D:\a\halcyon\halcyon\OpenSim\Base\IApplicationPlugin.cs:line 62
at OpenSim.Framework.PluginLoader`1.Load() in D:\a\halcyon\halcyon\OpenSim\Framework\PluginLoader.cs:line 191
at OpenSim.Framework.PluginLoader`1.Load(String extpoint) in D:\a\halcyon\halcyon\OpenSim\Framework\PluginLoader.cs:line 153
at OpenSim.OpenSimBase.LoadPlugins() in D:\a\halcyon\halcyon\OpenSim\Base\OpenSimBase.cs:line 170
at OpenSim.OpenSimBase.StartupSpecific() in D:\a\halcyon\halcyon\OpenSim\Base\OpenSimBase.cs:line 208
at OpenSim.OpenSim.StartupSpecific() in D:\a\halcyon\halcyon\OpenSim\Base\OpenSim.cs:line 163
at OpenSim.Framework.Servers.BaseOpenSimServer.Startup() in D:\a\halcyon\halcyon\OpenSim\Framework\Servers\BaseOpenSimServer.cs:line 300
at OpenSim.Application.Main(String[] args) in D:\a\halcyon\halcyon\InWorldz\Halcyon\Application.cs:line 153
Application is terminating: True
System.ComponentModel.Win32Exception
HResult=0x80004005
Message=The client and server cannot communicate, because they do not possess a common algorithm
Source=System
StackTrace:
at System.Net.SSPIWrapper.AcquireCredentialsHandle(SSPIInterface SecModule, String package, CredentialUse intent, SecureCredential scc)
at System.Net.Security.SecureChannel.AcquireCredentialsHandle(CredentialUse credUsage, SecureCredential& secureCredential)
at System.Net.Security.SecureChannel.AcquireClientCredentials(Byte[]& thumbPrint)
at System.Net.Security.SecureChannel.GenerateToken(Byte[] input, Int32 offset, Int32 count, Byte[]& output)
at System.Net.Security.SecureChannel.NextMessage(Byte[] incoming, Int32 offset, Int32 count)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at MySql.Data.MySqlClient.NativeDriver.StartSSL()
at MySql.Data.MySqlClient.NativeDriver.Open()
at MySql.Data.MySqlClient.Driver.Open()
at MySql.Data.MySqlClient.Driver.Create(MySqlConnectionStringBuilder settings)
at MySql.Data.MySqlClient.MySqlPool.GetPooledConnection()
at MySql.Data.MySqlClient.MySqlPool.TryToGetDriver()
at MySql.Data.MySqlClient.MySqlPool.GetConnection()
at MySql.Data.MySqlClient.MySqlConnection.Open()
at OpenSim.Data.SimpleDB.MySQLSimpleDB.OpenConnection() in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\MySQLSimpleDB.cs:line 88
at OpenSim.Data.SimpleDB.MySQLSimpleDB..ctor(String connectionString) in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\MySQLSimpleDB.cs:line 73
at OpenSim.Data.SimpleDB.ConnectionFactory.GetConnection() in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\ConnectionFactory.cs:line 28
at OpenSim.Data.MySQL.MySQLGridData.Initialize(String connect) in D:\a\halcyon\halcyon\OpenSim\Data\MySQL\MySQLGridData.cs:line 71
at OpenSim.Data.GridDataInitializer.Initialize(IPlugin plugin) in D:\a\halcyon\halcyon\OpenSim\Data\IGridData.cs:line 138
at OpenSim.Framework.PluginLoader`1.Load() in D:\a\halcyon\halcyon\OpenSim\Framework\PluginLoader.cs:line 191
at OpenSim.Data.DataPluginFactory.LoadDataPlugins[T](String provider, String connect) in D:\a\halcyon\halcyon\OpenSim\Data\DataPluginFactory.cs:line 129
at OpenSim.Grid.GridServer.Modules.GridDBService.AddPlugin(String provider, String connect) in D:\a\halcyon\halcyon\OpenSim\Grid\GridServer.Modules\GridDBService.cs:line 65
at OpenSim.Grid.GridServer.Modules.GridServerPlugin.SetupGridServices() in D:\a\halcyon\halcyon\OpenSim\Grid\GridServer.Modules\GridServerPlugin.cs:line 93
at OpenSim.Grid.GridServer.Modules.GridServerPlugin.Initialize(GridServerBase gridServer) in D:\a\halcyon\halcyon\OpenSim\Grid\GridServer.Modules\GridServerPlugin.cs:line 66
at OpenSim.Grid.GridServer.GridPluginInitializer.Initialize(IPlugin plugin) in D:\a\halcyon\halcyon\OpenSim\Grid\GridServer\IGridPlugin.cs:line 45
at OpenSim.Framework.PluginLoader`1.Load() in D:\a\halcyon\halcyon\OpenSim\Framework\PluginLoader.cs:line 191
at OpenSim.Framework.PluginLoader`1.Load(String extpoint) in D:\a\halcyon\halcyon\OpenSim\Framework\PluginLoader.cs:line 153
at OpenSim.Grid.GridServer.GridServerBase.LoadPlugins() in D:\a\halcyon\halcyon\OpenSim\Grid\GridServer\GridServerBase.cs:line 136
at OpenSim.Grid.GridServer.GridServerBase.StartupSpecific() in D:\a\halcyon\halcyon\OpenSim\Grid\GridServer\GridServerBase.cs:line 86
at OpenSim.Framework.Servers.BaseOpenSimServer.Startup() in D:\a\halcyon\halcyon\OpenSim\Framework\Servers\BaseOpenSimServer.cs:line 300
at OpenSim.Grid.GridServer.Program.Main(String[] args) in D:\a\halcyon\halcyon\OpenSim\Grid\GridServer\Program.cs:line 83
This exception was originally thrown at this call stack:
[External Code]
OpenSim.Data.SimpleDB.MySQLSimpleDB.OpenConnection() in MySQLSimpleDB.cs
OpenSim.Data.SimpleDB.MySQLSimpleDB.MySQLSimpleDB(string) in MySQLSimpleDB.cs
OpenSim.Data.SimpleDB.ConnectionFactory.GetConnection() in ConnectionFactory.cs
OpenSim.Data.MySQL.MySQLGridData.Initialize(string) in MySQLGridData.cs
OpenSim.Data.GridDataInitializer.Initialize(OpenSim.Framework.IPlugin) in IGridData.cs
OpenSim.Framework.PluginLoader<T>.Load() in PluginLoader.cs
OpenSim.Data.DataPluginFactory.LoadDataPlugins<T>(string, string) in DataPluginFactory.cs
OpenSim.Grid.GridServer.Modules.GridDBService.AddPlugin(string, string) in GridDBService.cs
OpenSim.Grid.GridServer.Modules.GridServerPlugin.SetupGridServices() in GridServerPlugin.cs
...
[Call Stack Truncated]
System.ComponentModel.Win32Exception
HResult=0x80004005
Message=The client and server cannot communicate, because they do not possess a common algorithm
Source=System
StackTrace:
at System.Net.SSPIWrapper.AcquireCredentialsHandle(SSPIInterface SecModule, String package, CredentialUse intent, SecureCredential scc)
at System.Net.Security.SecureChannel.AcquireCredentialsHandle(CredentialUse credUsage, SecureCredential& secureCredential)
at System.Net.Security.SecureChannel.AcquireClientCredentials(Byte[]& thumbPrint)
at System.Net.Security.SecureChannel.GenerateToken(Byte[] input, Int32 offset, Int32 count, Byte[]& output)
at System.Net.Security.SecureChannel.NextMessage(Byte[] incoming, Int32 offset, Int32 count)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at MySql.Data.MySqlClient.NativeDriver.StartSSL()
at MySql.Data.MySqlClient.NativeDriver.Open()
at MySql.Data.MySqlClient.Driver.Open()
at MySql.Data.MySqlClient.Driver.Create(MySqlConnectionStringBuilder settings)
at MySql.Data.MySqlClient.MySqlPool.GetPooledConnection()
at MySql.Data.MySqlClient.MySqlPool.TryToGetDriver()
at MySql.Data.MySqlClient.MySqlPool.GetConnection()
at MySql.Data.MySqlClient.MySqlConnection.Open()
at OpenSim.Data.SimpleDB.MySQLSimpleDB.OpenConnection() in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\MySQLSimpleDB.cs:line 88
at OpenSim.Data.SimpleDB.MySQLSimpleDB..ctor(String connectionString) in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\MySQLSimpleDB.cs:line 73
at OpenSim.Data.SimpleDB.ConnectionFactory.GetConnection() in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\ConnectionFactory.cs:line 28
at OpenSim.Data.MySQL.MySQLUserData.Initialize(String connect) in D:\a\halcyon\halcyon\OpenSim\Data\MySQL\MySQLUserData.cs:line 74
at OpenSim.Data.UserDataInitializer.Initialize(IPlugin plugin) in D:\a\halcyon\halcyon\OpenSim\Data\IUserData.cs:line 236
at OpenSim.Framework.PluginLoader`1.Load() in D:\a\halcyon\halcyon\OpenSim\Framework\PluginLoader.cs:line 191
at OpenSim.Data.DataPluginFactory.LoadDataPlugins[T](String provider, String connect) in D:\a\halcyon\halcyon\OpenSim\Data\DataPluginFactory.cs:line 129
at OpenSim.Framework.Communications.UserProfileManagerData.AddPlugin(String provider, String connect) in D:\a\halcyon\halcyon\OpenSim\Framework\Communications\UserProfileManagerData.cs:line 78
at OpenSim.Framework.Communications.UserProfileManager.AddPlugin(String provider, String connect) in D:\a\halcyon\halcyon\OpenSim\Framework\Communications\UserProfileManager.cs:line 162
at OpenSim.Grid.MessagingServer.OpenMessage_Main.StartupSpecific() in D:\a\halcyon\halcyon\OpenSim\Grid\MessagingServer\Main.cs:line 226
at OpenSim.Framework.Servers.BaseOpenSimServer.Startup() in D:\a\halcyon\halcyon\OpenSim\Framework\Servers\BaseOpenSimServer.cs:line 300
at OpenSim.Grid.MessagingServer.OpenMessage_Main.Main(String[] args) in D:\a\halcyon\halcyon\OpenSim\Grid\MessagingServer\Main.cs:line 100
This exception was originally thrown at this call stack:
[External Code]
OpenSim.Data.SimpleDB.MySQLSimpleDB.OpenConnection() in MySQLSimpleDB.cs
OpenSim.Data.SimpleDB.MySQLSimpleDB.MySQLSimpleDB(string) in MySQLSimpleDB.cs
OpenSim.Data.SimpleDB.ConnectionFactory.GetConnection() in ConnectionFactory.cs
OpenSim.Data.MySQL.MySQLUserData.Initialize(string) in MySQLUserData.cs
OpenSim.Data.UserDataInitializer.Initialize(OpenSim.Framework.IPlugin) in IUserData.cs
OpenSim.Framework.PluginLoader<T>.Load() in PluginLoader.cs
OpenSim.Data.DataPluginFactory.LoadDataPlugins<T>(string, string) in DataPluginFactory.cs
OpenSim.Framework.Communications.UserProfileManagerData.AddPlugin(string, string) in UserProfileManagerData.cs
OpenSim.Framework.Communications.UserProfileManager.AddPlugin(string, string) in UserProfileManager.cs
...
[Call Stack Truncated]
System.ComponentModel.Win32Exception
HResult=0x80004005
Message=The client and server cannot communicate, because they do not possess a common algorithm
Source=System
StackTrace:
at System.Net.SSPIWrapper.AcquireCredentialsHandle(SSPIInterface SecModule, String package, CredentialUse intent, SecureCredential scc)
at System.Net.Security.SecureChannel.AcquireCredentialsHandle(CredentialUse credUsage, SecureCredential& secureCredential)
at System.Net.Security.SecureChannel.AcquireClientCredentials(Byte[]& thumbPrint)
at System.Net.Security.SecureChannel.GenerateToken(Byte[] input, Int32 offset, Int32 count, Byte[]& output)
at System.Net.Security.SecureChannel.NextMessage(Byte[] incoming, Int32 offset, Int32 count)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at MySql.Data.MySqlClient.NativeDriver.StartSSL()
at MySql.Data.MySqlClient.NativeDriver.Open()
at MySql.Data.MySqlClient.Driver.Open()
at MySql.Data.MySqlClient.Driver.Create(MySqlConnectionStringBuilder settings)
at MySql.Data.MySqlClient.MySqlPool.GetPooledConnection()
at MySql.Data.MySqlClient.MySqlPool.TryToGetDriver()
at MySql.Data.MySqlClient.MySqlPool.GetConnection()
at MySql.Data.MySqlClient.MySqlConnection.Open()
at OpenSim.Data.SimpleDB.MySQLSimpleDB.OpenConnection() in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\MySQLSimpleDB.cs:line 88
at OpenSim.Data.SimpleDB.MySQLSimpleDB..ctor(String connectionString) in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\MySQLSimpleDB.cs:line 73
at OpenSim.Data.SimpleDB.ConnectionFactory.GetConnection() in D:\a\halcyon\halcyon\OpenSim\Data\SimpleDB\ConnectionFactory.cs:line 28
at OpenSim.Data.MySQL.MySQLUserData.Initialize(String connect) in D:\a\halcyon\halcyon\OpenSim\Data\MySQL\MySQLUserData.cs:line 74
at OpenSim.Data.UserDataInitializer.Initialize(IPlugin plugin) in D:\a\halcyon\halcyon\OpenSim\Data\IUserData.cs:line 236
at OpenSim.Framework.PluginLoader`1.Load() in D:\a\halcyon\halcyon\OpenSim\Framework\PluginLoader.cs:line 191
at OpenSim.Data.DataPluginFactory.LoadDataPlugins[T](String provider, String connect) in D:\a\halcyon\halcyon\OpenSim\Data\DataPluginFactory.cs:line 129
at OpenSim.Framework.Communications.UserProfileManagerData.AddPlugin(String provider, String connect) in D:\a\halcyon\halcyon\OpenSim\Framework\Communications\UserProfileManagerData.cs:line 78
at OpenSim.Framework.Communications.UserProfileManager.AddPlugin(String provider, String connect) in D:\a\halcyon\halcyon\OpenSim\Framework\Communications\UserProfileManager.cs:line 162
at OpenSim.Grid.UserServer.Modules.UserDataBaseService.Initialize(IGridServiceCore core) in D:\a\halcyon\halcyon\OpenSim\Grid\UserServer.Modules\UserDataBaseService.cs:line 59
at OpenSim.Grid.UserServer.OpenUser_Main.StartupUserServerModules() in D:\a\halcyon\halcyon\OpenSim\Grid\UserServer\Main.cs:line 220
at OpenSim.Grid.UserServer.OpenUser_Main.StartupSpecific() in D:\a\halcyon\halcyon\OpenSim\Grid\UserServer\Main.cs:line 155
at OpenSim.Framework.Servers.BaseOpenSimServer.Startup() in D:\a\halcyon\halcyon\OpenSim\Framework\Servers\BaseOpenSimServer.cs:line 300
at OpenSim.Grid.UserServer.OpenUser_Main.Main(String[] args) in D:\a\halcyon\halcyon\OpenSim\Grid\UserServer\Main.cs:line 118
This exception was originally thrown at this call stack:
[External Code]
OpenSim.Data.SimpleDB.MySQLSimpleDB.OpenConnection() in MySQLSimpleDB.cs
OpenSim.Data.SimpleDB.MySQLSimpleDB.MySQLSimpleDB(string) in MySQLSimpleDB.cs
OpenSim.Data.SimpleDB.ConnectionFactory.GetConnection() in ConnectionFactory.cs
OpenSim.Data.MySQL.MySQLUserData.Initialize(string) in MySQLUserData.cs
OpenSim.Data.UserDataInitializer.Initialize(OpenSim.Framework.IPlugin) in IUserData.cs
OpenSim.Framework.PluginLoader<T>.Load() in PluginLoader.cs
OpenSim.Data.DataPluginFactory.LoadDataPlugins<T>(string, string) in DataPluginFactory.cs
OpenSim.Framework.Communications.UserProfileManagerData.AddPlugin(string, string) in UserProfileManagerData.cs
OpenSim.Framework.Communications.UserProfileManager.AddPlugin(string, string) in UserProfileManager.cs
...
[Call Stack Truncated]
---------------------------
Halcyon.exe - This application could not be started.
---------------------------
This application requires one of the following versions of the .NET Framework:
.NETFramework,Version=v4.8
Do you want to install this .NET Framework version now?
---------------------------
Yes No
---------------------------
This started after I had applied Vin's recommendation in the registry and group policy. Although I had SSL 2.0 and SSL 3.0 enabled for a short time so it could have been vulnerable to something during that time.
DisableOldWinCiphers
See associated picture: disable-ssl2-in-iis.png
Following content is saved in DisableOldWinCiphers.reg ready to load into the Registry.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL]
"EventLogging"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CipherSuites]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
"ServerMinKeyBitLength"=dword:00000800
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
"DisabledByDefault"=dword:00000001
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:00000001
<!-- The following forces the server to only accept the Diffie-Hellman at 2048 bits. -->
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
"ServerMinKeyBitLength"=dword:00000800
Manually doing the Above changes:
Disabling outdate TLS on Windows Server 2008 / 2012 R2:
Open the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\
Now we have to enable versions 1.1 and 1.2 of TLS. For this, we need to create new keys called 'TLS 1.1' and 'TLS 1.2' underneath the 'Protocols' key.
Once the key structure is created, you can proceed to creating a DWORD (32 bit) entry called 'DisabledByDefault' and set its value to '0' in each of the four keys: TLS 1.1/Client, TLS 1.1/Server, TLS 1.2/Client and TLS 1.2/Server.
For the TLS 1.0, TLS 1.1 set new DWORD DisabledByDefault=1 to disable them. Allow for TLS 1.2: DisabledByDefault=0
Also see this: https://howtogeek.com/221080/how-to-update-your-windows-server-cipher-suite-for-better-security/
and the list: https://grc.com/miscfiles/SChannel_Cipher_Suites.txt
Installed this list on GLCWeb.
Run gpedit.msc to change the following:
Select
Computer Configuration
Administrative Templates
Network
SSL Configuration Settings
DblClick on "SSL Cipher Suite Order"
enable
Copy the below to the entry box.
Test validation using https://ssllabs.com/ssltest
https://ssllabs.com/ssltest/analyze.html?d=grid.toallchurches.net
Apparently the AES-GCM Ciphers need to be above the AES-CBC Ciphers. (that's what Chat GPT indicated)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,ECDHE_RSA_AES256_GCM_SHA384,ECDHE_RSA_AES128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_CK_DES_192_EDE3_CBC_WITH_MD5
(Did not do this part as he said I didn't need it.)
Put Certificates.msc in the FilezillaCert folder. Use to remove out dated Trust and intermediary SSLs.
Copy the file powershell.exe.config to:
C:\Windows\System32\WindowsPowerShell\v1.0 folder.
Add this line to the top of C:\RegionChk.ps1:
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
Restart the server.
When I removed all of the weak ciphers from the above, as noted by the SSLLabs.com site, I couldn't connect on the Remote Desktop Connection.
# TLS 1.2 (suites in server-preferred order)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f) DH 2048 bits FS 256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e) DH 2048 bits FS 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH secp384r1 (eq. 7680 bits RSA) FS WEAK 256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) ECDH secp256r1 (eq. 3072 bits RSA) FS WEAK 256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH secp521r1 (eq. 15360 bits RSA) FS WEAK 128
TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) WEAK 256
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) WEAK 128
Two or three people have told me that I should update my server OS, and that's probably true. Although the folks who run the VPS company that my server is on have not yet setup a backup drive for me, so I can do a couple of in-place upgrades.
Thank you, Shalom.