SSL证书没有所谓的"品质"和"等级"之分&＃xff0c;只有三种不同的类型。
SSL证书需要向国际公认的证书证书认证机构&＃xff08;简称CA&＃xff0c;Certificate Authority&＃xff09;申请。
CA机构颁发的证书有3种类型&＃xff1a;
域名型SSL证书&＃xff08;DV SSL&＃xff09;&＃xff1a;信任等级普通&＃xff0c;只需验证网站的真实性便可颁发证书保护网站&＃xff1b;
企业型SSL证书&＃xff08;OV SSL&＃xff09;&＃xff1a;信任等级强&＃xff0c;须要验证企业的身份&＃xff0c;审核严格&＃xff0c;安全性更高&＃xff1b;
增强型SSL证书&＃xff08;EV SSL&＃xff09;&＃xff1a;信任等级最高&＃xff0c;一般用于银行证券等金融机构&＃xff0c;审核严格&＃xff0c;安全性最高&＃xff0c;同时可以激活绿色网址栏。
我们只要使用DV证书就可以了&＃xff0c;一般来说我们申请到的免费ssl证书都是dv证书。
2.申请免费的证书
2.1 自签名惹的祸
Ca证书必须要可信任的机构颁发才可以信任&＃xff0c;自签名证书就是自己给自己签名&＃xff0c;没有通过第三方CA机构颁发。浏览器默认添加了一些可信任的CA机构&＃xff0c;都是通过国际Web Trust认证的。
如果你的CA证书不是这些浏览器里默认添加的可信任的CA机构签发的话&＃xff0c;那么就会出现像12306这样的笑话。
2.2申请免费的DV证书
Let&＃39;s Encrypt是国外一个公共的免费SSL项目&＃xff0c;由 Linux 基金会托管&＃xff0c;由Mozilla、思科、Akamai、IdenTrust和EFF等组织发起&＃xff0c;靠谱&＃xff01;
申请免费的证书可以参考这篇文章&＃xff0c;工具和步骤都非常的完整&＃xff0c;这里就不累述了
http://www.cnblogs.com/teamblog/p/6219204.html
最后申请完之后iis的配置就是新建一个网站&＃xff0c;其他都不用配置&＃xff0c;就可以了&＃xff0c;老的网站不要删除&＃xff0c;如果要强制https访问的话可以再搜索其他的文章&＃xff0c;这里不再展开
3.https网站安全验证
https已经可以访问了&＃xff0c;但是https就一定是安全的吗&＃xff0c;我们可以通过下面这个网站进一步检查你的网站的安全性&＃xff0c;主要是从https的安全性去测试
https://www.ssllabs.com/ssltest/analyze.html
可能一开始测试是个F&＃xff0c;像我一开始测试就是个F&＃xff0c;这是因为操作系统的默认设置里有很多不安全的设置&＃xff0c;需要我们手动来配置修改。
可以仔细看下面的说明&＃xff0c;没有开启TLS1.2 &＃xff0c;RC4已经过时了&＃xff0c;Forward Secrecy支持的不好等等。
4.为了A&＃43;不断修改
这里大段的删除线是我一下午的心血&＃xff0c;哪怕最后发现了powerShell脚本可以一次性完成上面所有的工作&＃xff0c;你可以不看&＃xff0c;但请尊重我的劳动
4.1 关闭SLL2和SSL3
找到HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols右键->新建->项->新建SSL 2.0&＃xff0c;SSL 3.0
SSL 2.0和SSL 3.0 中间是有空格的&＃xff01;&＃xff01;&＃xff01;
在SSL 2.0 和 SSL 3.0上分别右键->新建->项->新建Server, Client
在新建的Server和Client中都新建如下的项(DWORD 32位值),
DisabledByDefault 值1
Enabled 值0
总共8个
、
4.2 开启TLS1.0 1.1 1.2
还是在刚才的目录下面&＃xff0c;新建3个TLS 1.0 &＃xff0c;TLS 1.1&＃xff0c;TLS 1.2
然后分别在下面建立Client&＃xff0c;Server
然后跟一样在每个里面建立下面的项(DWORD 32位值)
DisabledByDefault 值 0
Enabled 值1
图都一样&＃xff0c;就不重复截图了
完成上面的步骤后重启服务器就可以看到效果了
4.3 关闭RC4
这里的步骤更复杂&＃xff0c;但和上面大同小异 &＃xff0c;无非就是在注册表里创建项&＃xff0c;设置键值。
但是做到这里&＃xff0c;我发现最后一步的powerShell脚本把所有的事都做了。所以后面的步骤我们都省略吧&＃xff01;&＃xff01;&＃xff01;&＃xff01;&＃xff01;&＃xff01;&＃xff01;&＃xff01;
4.5 修改ssl配置设置
别的我就说&＃xff0c;在这个ssl配置的时候我尝试了很多种Cipher Suites的配置方式&＃xff0c;包括参考别人A&＃43;的网站上报告里的配置&＃xff0c;一个一个复制出来&＃xff0c;每次都要重启服务器&＃xff0c;重新测试&＃xff0c;花了好多时间&＃xff0c;最后终于评价成为A-&＃xff0c;剩下一个Forward Secrecy的问题&＃xff0c;结果搜索到一份powershell的脚本&＃xff0c;问题是一步一步处理的&＃xff0c;没毛病&＃xff0c;但最后找到一个脚本一次性解决了前面所有的问题&＃xff0c;所以分享出来给大家&＃xff0c;减少大家走弯路的时间
4.6 最后配置 Forward Secrecy
4.7 一键配置的powershell脚本
Powershell脚本原文&＃xff1a;
https://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12
使用方法是&＃xff0c;开始-》运行-》输入powershell&＃xff0c;打开类似cmd窗口的命令行工具&＃xff0c;然后直接复制脚本进去执行就ok了。
# Copyright 2016, Alexander Hass
# http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12
#
# Version 1.7
# - Windows Version compare failed. Get-CimInstance requires Windows 2012 or later.
# Version 1.6
# - OS version detection for cipher suites order.
# Version 1.5
# - Enabled ECDH and more secure hash functions and reorderd cipher list.
# - Added Client setting for all ciphers.
# Version 1.4
# - RC4 has been disabled.
# Version 1.3
# - MD5 has been disabled.
# Version 1.2
# - Re-factored code style and output
# Version 1.1
# - SSLv3 has been disabled. (Poodle attack protection)Write-Host &＃39;Configuring IIS with SSL/TLS Deployment Best Practices...&＃39;
Write-Host &＃39;--------------------------------------------------------------------------------&＃39;# Disable Multi-Protocol Unified Hello
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server&＃39; -name Enabled -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server&＃39; -name &＃39;DisabledByDefault&＃39; -value 1 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client&＃39; -name Enabled -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client&＃39; -name &＃39;DisabledByDefault&＃39; -value 1 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
Write-Host &＃39;Multi-Protocol Unified Hello has been disabled.&＃39;# Disable PCT 1.0
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server&＃39; -name Enabled -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server&＃39; -name &＃39;DisabledByDefault&＃39; -value 1 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client&＃39; -name Enabled -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client&＃39; -name &＃39;DisabledByDefault&＃39; -value 1 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
Write-Host &＃39;PCT 1.0 has been disabled.&＃39;# Disable SSL 2.0 (PCI Compliance)
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server&＃39; -name Enabled -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server&＃39; -name &＃39;DisabledByDefault&＃39; -value 1 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client&＃39; -name Enabled -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client&＃39; -name &＃39;DisabledByDefault&＃39; -value 1 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
Write-Host &＃39;SSL 2.0 has been disabled.&＃39;# NOTE: If you disable SSL 3.0 the you may lock out some people still using
# Windows XP with IE6/7. Without SSL 3.0 enabled, there is no protocol available
# for these people to fall back. Safer shopping certifications may require that
# you disable SSLv3.
#
# Disable SSL 3.0 (PCI Compliance) and enable "Poodle" protection
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server&＃39; -name Enabled -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server&＃39; -name &＃39;DisabledByDefault&＃39; -value 1 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client&＃39; -name Enabled -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client&＃39; -name &＃39;DisabledByDefault&＃39; -value 1 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
Write-Host &＃39;SSL 3.0 has been disabled.&＃39;# Add and Enable TLS 1.0 for client and server SCHANNEL communications
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server&＃39; -name &＃39;Enabled&＃39; -value &＃39;0xffffffff&＃39; -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server&＃39; -name &＃39;DisabledByDefault&＃39; -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client&＃39; -name &＃39;Enabled&＃39; -value &＃39;0xffffffff&＃39; -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client&＃39; -name &＃39;DisabledByDefault&＃39; -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
Write-Host &＃39;TLS 1.0 has been enabled.&＃39;# Add and Enable TLS 1.1 for client and server SCHANNEL communications
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server&＃39; -name &＃39;Enabled&＃39; -value &＃39;0xffffffff&＃39; -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server&＃39; -name &＃39;DisabledByDefault&＃39; -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client&＃39; -name &＃39;Enabled&＃39; -value &＃39;0xffffffff&＃39; -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client&＃39; -name &＃39;DisabledByDefault&＃39; -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
Write-Host &＃39;TLS 1.1 has been enabled.&＃39;# Add and Enable TLS 1.2 for client and server SCHANNEL communications
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server&＃39; -name &＃39;Enabled&＃39; -value &＃39;0xffffffff&＃39; -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server&＃39; -name &＃39;DisabledByDefault&＃39; -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client&＃39; -name &＃39;Enabled&＃39; -value &＃39;0xffffffff&＃39; -PropertyType &＃39;DWord&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client&＃39; -name &＃39;DisabledByDefault&＃39; -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null
Write-Host &＃39;TLS 1.2 has been enabled.&＃39;# Re-create the ciphers key.
New-Item &＃39;HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers&＃39; -Force | Out-Null# Disable insecure/weak ciphers.
$insecureCiphers &＃61; &＃64;(&＃39;DES 56/56&＃39;,&＃39;NULL&＃39;,&＃39;RC2 128/128&＃39;,&＃39;RC2 40/128&＃39;,&＃39;RC2 56/128&＃39;,&＃39;RC4 40/128&＃39;,&＃39;RC4 56/128&＃39;,&＃39;RC4 64/128&＃39;,&＃39;RC4 128/128&＃39;
)
Foreach ($insecureCipher in $insecureCiphers) {$key &＃61; (Get-Item HKLM:\).OpenSubKey(&＃39;SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers&＃39;, $true).CreateSubKey($insecureCipher)$key.SetValue(&＃39;Enabled&＃39;, 0, &＃39;DWord&＃39;)$key.close()Write-Host "Weak cipher $insecureCipher has been disabled."
}# Enable new secure ciphers.
# - RC4: It is recommended to disable RC4, but you may lock out WinXP/IE8 if you enforce this. This is a requirement for FIPS 140-2.
# - 3DES: It is recommended to disable these in near future. This is the last cipher supported by Windows XP.
# - Windows Vista and before &＃39;Triple DES 168&＃39; was named &＃39;Triple DES 168/168&＃39; per https://support.microsoft.com/en-us/kb/245030
$secureCiphers &＃61; &＃64;(&＃39;AES 128/128&＃39;,&＃39;AES 256/256&＃39;,&＃39;Triple DES 168&＃39;
)
Foreach ($secureCipher in $secureCiphers) {$key &＃61; (Get-Item HKLM:\).OpenSubKey(&＃39;SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers&＃39;, $true).CreateSubKey($secureCipher)New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\$secureCipher" -name &＃39;Enabled&＃39; -value &＃39;0xffffffff&＃39; -PropertyType &＃39;DWord&＃39; -Force | Out-Null$key.close()Write-Host "Strong cipher $secureCipher has been enabled."
}# Set hashes configuration.
New-Item &＃39;HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes&＃39; -Force | Out-Null
New-Item &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5&＃39; -Force | Out-Null
New-ItemProperty -path &＃39;HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5&＃39; -name Enabled -value 0 -PropertyType &＃39;DWord&＃39; -Force | Out-Null$secureHashes &＃61; &＃64;(&＃39;SHA&＃39;,&＃39;SHA256&＃39;,&＃39;SHA384&＃39;,&＃39;SHA512&＃39;
)
Foreach ($secureHash in $secureHashes) {$key &＃61; (Get-Item HKLM:\).OpenSubKey(&＃39;SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes&＃39;, $true).CreateSubKey($secureHash)New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\$secureHash" -name &＃39;Enabled&＃39; -value &＃39;0xffffffff&＃39; -PropertyType &＃39;DWord&＃39; -Force | Out-Null$key.close()Write-Host "Hash $secureHash has been enabled."
}# Set KeyExchangeAlgorithms configuration.
New-Item &＃39;HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms&＃39; -Force | Out-Null
$secureKeyExchangeAlgorithms &＃61; &＃64;(&＃39;Diffie-Hellman&＃39;,&＃39;ECDH&＃39;,&＃39;PKCS&＃39;
)
Foreach ($secureKeyExchangeAlgorithm in $secureKeyExchangeAlgorithms) {$key &＃61; (Get-Item HKLM:\).OpenSubKey(&＃39;SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms&＃39;, $true).CreateSubKey($secureKeyExchangeAlgorithm)New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\$secureKeyExchangeAlgorithm" -name &＃39;Enabled&＃39; -value &＃39;0xffffffff&＃39; -PropertyType &＃39;DWord&＃39; -Force | Out-Null$key.close()Write-Host "KeyExchangeAlgorithm $secureKeyExchangeAlgorithm has been enabled."
}# Set cipher suites order as secure as possible (Enables Perfect Forward Secrecy).
$os &＃61; Get-WmiObject -class Win32_OperatingSystem
if ([System.Version]$os.Version -lt [System.Version]&＃39;10.0&＃39;) {Write-Host &＃39;Use cipher suites order for Windows 2008R2/2012/2012R2.&＃39;$cipherSuitesOrder &＃61; &＃64;(&＃39;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256&＃39;,&＃39;TLS_RSA_WITH_AES_256_GCM_SHA384&＃39;,&＃39;TLS_RSA_WITH_AES_128_GCM_SHA256&＃39;,&＃39;TLS_RSA_WITH_AES_256_CBC_SHA256&＃39;,&＃39;TLS_RSA_WITH_AES_128_CBC_SHA256&＃39;,&＃39;TLS_RSA_WITH_AES_256_CBC_SHA&＃39;,&＃39;TLS_RSA_WITH_AES_128_CBC_SHA&＃39;,&＃39;TLS_RSA_WITH_3DES_EDE_CBC_SHA&＃39;)
}
else {Write-Host &＃39;Use cipher suites order for Windows 10/2016 and later.&＃39;$cipherSuitesOrder &＃61; &＃64;(&＃39;TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA&＃39;,&＃39;TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA&＃39;,&＃39;TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA&＃39;,&＃39;TLS_RSA_WITH_AES_256_GCM_SHA384&＃39;,&＃39;TLS_RSA_WITH_AES_128_GCM_SHA256&＃39;,&＃39;TLS_RSA_WITH_AES_256_CBC_SHA256&＃39;,&＃39;TLS_RSA_WITH_AES_128_CBC_SHA256&＃39;,&＃39;TLS_RSA_WITH_AES_256_CBC_SHA&＃39;,&＃39;TLS_RSA_WITH_AES_128_CBC_SHA&＃39;,&＃39;TLS_RSA_WITH_3DES_EDE_CBC_SHA&＃39;)
}
$cipherSuitesAsString &＃61; [string]::join(&＃39;,&＃39;, $cipherSuitesOrder)
# One user reported this key does not exists on Windows 2012R2. Cannot repro myself on a brand new Windows 2012R2 core machine. Adding this just to be save.
New-Item &＃39;HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002&＃39; -ErrorAction SilentlyContinue
New-ItemProperty -path &＃39;HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002&＃39; -name &＃39;Functions&＃39; -value $cipherSuitesAsString -PropertyType &＃39;String&＃39; -Force | Out-NullWrite-Host &＃39;--------------------------------------------------------------------------------&＃39;
Write-Host &＃39;NOTE: After the system has been rebooted you can verify your server&＃39;
Write-Host &＃39; configuration at https://www.ssllabs.com/ssltest/&＃39;
Write-Host "--------------------------------------------------------------------------------&＃96;n"Write-Host -ForegroundColor Red &＃39;A computer restart is required to apply settings. Restart computer now?&＃39;
Restart-Computer -Force -Confirm
4.8 最后成功评价到A
至于A&＃43;还应该怎么做&＃xff0c;我也不知道该怎么做下去了&＃xff0c;一下午的劳动最后一个脚本就全部搞定了&＃xff0c;为了防止大家再走弯路分享给大家&＃xff0c;希望大家都能评价到A&＃43;。
京公网安备 11010802041100号