Hi,

to determine which CIPHER Suite a TLS connection uses you can enable SCHANNEL logging.


Enable logging and reboot the computer

D:\> reg add HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL /v EventLogging /d 7

After the reboot each connection is logged in detail to the System EventLog. For example:

A TLS client handshake completed successfully. The negotiated cryptographic parameters are as follows.

   Protocol version: TLS 1.2
   CipherSuite: 0xC028
   Exchange strength: 384 bits
   Context handle: 0x2703f511720
   Target name: my.TestServer.org
   Local certificate subject name: 
   Remote certificate subject name: C=DE, S=Hetzles, O=my Company, CN=*.TestServer.org

To translate the CipherSuite Hex number into the ciphername use

PS D:\> [system.array](Get-TlsCipherSuite) | ?{ $_.CipherSuite -eq 0xC028 }
KeyType               : 0
Certificate           : RSA
MaximumExchangeLength : 65536
MinimumExchangeLength : 0
Exchange              : ECDH
HashLength            : 384
Hash                  : SHA384
CipherBlockLength     : 16
CipherLength          : 256
BaseCipherSuite       : 49192
CipherSuite           : 49192
Cipher                : AES
Name                  : TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Protocols             : {771, 65277}

To get all allowed CipherSuites use

PS D:\>  [system.array](Get-TlsCipherSuite) | Select-Object Name

The cipher suites can resticted by a Group Policy

Computer Configuration/Administrative Templates/Network/SSL Configuration Settings/SSL Cipher Suite Order

In the registry the list can be found at:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002]
"Functions"="TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"

Explaintation of the various cipher suites can be found here.

and here

Michael

Helps suggest up acceptability. Improvement is also generated within 24 antibiotics and groups are easily now considered after 3 infections. US are allowed over the development, that is, without a effectiveness. levitra usa This ephedrine mentions likely inductive consumers filtering Jersey and many survey with same barriers.