2

Everything I can find on disabling TLS 1.0/1.1 and SSL 3.0 involves editing the registry to disable it at the server level.

Unfortunately our website communicates with a vendor application that still requires TLS 1.1, and disabling it at the server level breaks it for that connection.

Is there a way to disable TLS/SSL specifically for our website while leaving it active at the server level?

CodeRedick
  • 277
  • 1
  • 4
  • 7
  • 1
    I don't think there is a way to do this. – Zoredache Dec 09 '19 at 18:22
  • I think this qualifies as a duplicate, but I'm not totally sure. [Is it possible to force TLS 1.2 on an IIS Site](https://serverfault.com/questions/771161/is-it-possible-to-force-tls-1-2-on-an-iis-site) – Moshe Katz Dec 09 '19 at 18:47

2 Answers2

4

You can't do it.

The newest IIS (v10 - on Server 2019) lets you choose "Disable Legacy TLS" on a per-binding level, but the version you have cannot do it.

Realistically, there are only two ways to do what you want:

  1. Upgrade to Windows Server 2019
  2. Set up an edge reverse proxy to handle SSL termination for your website and send it back to your main server. The edge proxy will handle only modern TLS versions and the actual server will not be accessible from outside.
Moshe Katz
  • 3,112
  • 5
  • 28
  • 43
0

You can always use IISCrypto, link below. Be careful, if you don't know what you are doing you can break shtuff.

https://www.nartac.com/Products/IISCrypto/ :D

blackstabs
  • 34
  • 2