Windows Server 2008 R2 下配置TLS1.2，添加自签名证书

前言

2017年1月1日起App Store上的所有App应用将强制开启ATS功能。

苹果的ATS(App Transport Security)对服务器硬性3点要求：

① ATS要求TLS1.2或者更高，TLS 是 SSL 新的别称。

② 通讯中的加密套件配置要求支持列出的正向保密。

③ 数字证书必须使用sha256或者更高级的签名哈希算法，并且保证密钥是2048位及以上的RSA密钥或者256位及以上的ECC密钥。

由于领导舍不得花钱，只能辛苦我们自己搞个不花钱的证书。在网上找了一大堆各种配置证书服务的文章，在ios端运行的时候总是直接报错，很是费解，后来注意到必须是TLS1.2或者更高的版本，而按照网上的配置弄好后都是ssl1.0，根本原因没有解决。所以必须先升级服务器ssl的版本，这个升级的文章很多，有用的不多。在这里整理下找到的资料，供大家参考。注意：证书服务可以不用安装，升级ssl后即可正常访问。

1.首先打开服务器组策略，命令行输入gpedit.msc，找到ssl配置设置，双击ssl密码套件顺序，选择已启用，并保存。准备工作完成！

2.在下面选择您需要的配置并复制，打开Powershell直接粘贴。最后会提示是否重启服务器，输入Y会直接重启，根据自己的情况而定吧，重启后生效哦~

2.1. configure your IIS server with Perfect Forward Secrecy and TLS 1.2:

# Copyright 2016, Alexander Hass
# http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12
#
# Version 1.7
# - Windows Version compare failed. Get-CimInstance requires Windows 2012 or later.
# Version 1.6
# - OS version detection for cipher suites order.
# Version 1.5
# - Enabled ECDH and more secure hash functions and reorderd cipher list.
# - Added Client setting for all ciphers.
# Version 1.4
# - RC4 has been disabled.
# Version 1.3
# - MD5 has been disabled.
# Version 1.2
# - Re-factored code style and output
# Version 1.1
# - SSLv3 has been disabled. (Poodle attack protection)

Write-Host ‘Configuring IIS with SSL/TLS Deployment Best Practices...‘
Write-Host ‘--------------------------------------------------------------------------------‘

# Disable Multi-Protocol Unified Hello
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server‘ -name Enabled -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server‘ -name ‘DisabledByDefault‘ -value 1 -PropertyType ‘DWord‘ -Force | Out-Null
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client‘ -name Enabled -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client‘ -name ‘DisabledByDefault‘ -value 1 -PropertyType ‘DWord‘ -Force | Out-Null
Write-Host ‘Multi-Protocol Unified Hello has been disabled.‘

# Disable PCT 1.0
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server‘ -name Enabled -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server‘ -name ‘DisabledByDefault‘ -value 1 -PropertyType ‘DWord‘ -Force | Out-Null
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client‘ -name Enabled -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client‘ -name ‘DisabledByDefault‘ -value 1 -PropertyType ‘DWord‘ -Force | Out-Null
Write-Host ‘PCT 1.0 has been disabled.‘

# Disable SSL 2.0 (PCI Compliance)
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server‘ -name Enabled -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server‘ -name ‘DisabledByDefault‘ -value 1 -PropertyType ‘DWord‘ -Force | Out-Null
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client‘ -name Enabled -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client‘ -name ‘DisabledByDefault‘ -value 1 -PropertyType ‘DWord‘ -Force | Out-Null
Write-Host ‘SSL 2.0 has been disabled.‘

# NOTE: If you disable SSL 3.0 the you may lock out some people still using
# Windows XP with IE6/7. Without SSL 3.0 enabled, there is no protocol available
# for these people to fall back. Safer shopping certifications may require that
# you disable SSLv3.
#
# Disable SSL 3.0 (PCI Compliance) and enable "Poodle" protection
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server‘ -name Enabled -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server‘ -name ‘DisabledByDefault‘ -value 1 -PropertyType ‘DWord‘ -Force | Out-Null
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client‘ -name Enabled -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client‘ -name ‘DisabledByDefault‘ -value 1 -PropertyType ‘DWord‘ -Force | Out-Null
Write-Host ‘SSL 3.0 has been disabled.‘

# Add and Enable TLS 1.0 for client and server SCHANNEL communications
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server‘ -name ‘Enabled‘ -value ‘0xffffffff‘ -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server‘ -name ‘DisabledByDefault‘ -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client‘ -name ‘Enabled‘ -value ‘0xffffffff‘ -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client‘ -name ‘DisabledByDefault‘ -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
Write-Host ‘TLS 1.0 has been enabled.‘

# Add and Enable TLS 1.1 for client and server SCHANNEL communications
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server‘ -name ‘Enabled‘ -value ‘0xffffffff‘ -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server‘ -name ‘DisabledByDefault‘ -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client‘ -name ‘Enabled‘ -value ‘0xffffffff‘ -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client‘ -name ‘DisabledByDefault‘ -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
Write-Host ‘TLS 1.1 has been enabled.‘

# Add and Enable TLS 1.2 for client and server SCHANNEL communications
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server‘ -name ‘Enabled‘ -value ‘0xffffffff‘ -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server‘ -name ‘DisabledByDefault‘ -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client‘ -name ‘Enabled‘ -value ‘0xffffffff‘ -PropertyType ‘DWord‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client‘ -name ‘DisabledByDefault‘ -value 0 -PropertyType ‘DWord‘ -Force | Out-Null
Write-Host ‘TLS 1.2 has been enabled.‘

# Re-create the ciphers key.
New-Item ‘HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers‘ -Force | Out-Null

# Disable insecure/weak ciphers.
$insecureCiphers = @(
  ‘DES 56/56‘,
  ‘NULL‘,
  ‘RC2 128/128‘,
  ‘RC2 40/128‘,
  ‘RC2 56/128‘,
  ‘RC4 40/128‘,
  ‘RC4 56/128‘,
  ‘RC4 64/128‘,
  ‘RC4 128/128‘
)
Foreach ($insecureCipher in $insecureCiphers) {
  $key = (Get-Item HKLM:\).OpenSubKey(‘SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers‘, $true).CreateSubKey($insecureCipher)
  $key.SetValue(‘Enabled‘, 0, ‘DWord‘)
  $key.close()
  Write-Host "Weak cipher $insecureCipher has been disabled."
}

# Enable new secure ciphers.
# - RC4: It is recommended to disable RC4, but you may lock out WinXP/IE8 if you enforce this. This is a requirement for FIPS 140-2.
# - 3DES: It is recommended to disable these in near future. This is the last cipher supported by Windows XP.
# - Windows Vista and before ‘Triple DES 168‘ was named ‘Triple DES 168/168‘ per https://support.microsoft.com/en-us/kb/245030
$secureCiphers = @(
  ‘AES 128/128‘,
  ‘AES 256/256‘,
  ‘Triple DES 168‘
)
Foreach ($secureCipher in $secureCiphers) {
  $key = (Get-Item HKLM:\).OpenSubKey(‘SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers‘, $true).CreateSubKey($secureCipher)
  New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\$secureCipher" -name ‘Enabled‘ -value ‘0xffffffff‘ -PropertyType ‘DWord‘ -Force | Out-Null
  $key.close()
  Write-Host "Strong cipher $secureCipher has been enabled."
}

# Set hashes configuration.
New-Item ‘HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes‘ -Force | Out-Null
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5‘ -Force | Out-Null
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5‘ -name Enabled -value 0 -PropertyType ‘DWord‘ -Force | Out-Null

$secureHashes = @(
  ‘SHA‘,
  ‘SHA256‘,
  ‘SHA384‘,
  ‘SHA512‘
)
Foreach ($secureHash in $secureHashes) {
  $key = (Get-Item HKLM:\).OpenSubKey(‘SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes‘, $true).CreateSubKey($secureHash)
  New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\$secureHash" -name ‘Enabled‘ -value ‘0xffffffff‘ -PropertyType ‘DWord‘ -Force | Out-Null
  $key.close()
  Write-Host "Hash $secureHash has been enabled."
}

# Set KeyExchangeAlgorithms configuration.
New-Item ‘HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms‘ -Force | Out-Null
$secureKeyExchangeAlgorithms = @(
  ‘Diffie-Hellman‘,
  ‘ECDH‘,
  ‘PKCS‘
)
Foreach ($secureKeyExchangeAlgorithm in $secureKeyExchangeAlgorithms) {
  $key = (Get-Item HKLM:\).OpenSubKey(‘SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms‘, $true).CreateSubKey($secureKeyExchangeAlgorithm)
  New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\$secureKeyExchangeAlgorithm" -name ‘Enabled‘ -value ‘0xffffffff‘ -PropertyType ‘DWord‘ -Force | Out-Null
  $key.close()
  Write-Host "KeyExchangeAlgorithm $secureKeyExchangeAlgorithm has been enabled."
}

# Set cipher suites order as secure as possible (Enables Perfect Forward Secrecy).
$os = Get-WmiObject -class Win32_OperatingSystem
if ([System.Version]$os.Version -lt [System.Version]‘10.0‘) {
  Write-Host ‘Use cipher suites order for Windows 2008R2/2012/2012R2.‘
  $cipherSuitesOrder = @(
    ‘TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521‘,
    ‘TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384‘,
    ‘TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256‘,
    ‘TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521‘,
    ‘TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384‘,
    ‘TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256‘,
    ‘TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521‘,
    ‘TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384‘,
    ‘TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256‘,
    ‘TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521‘,
    ‘TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384‘,
    ‘TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256‘,
    ‘TLS_RSA_WITH_AES_256_GCM_SHA384‘,
    ‘TLS_RSA_WITH_AES_128_GCM_SHA256‘,
    ‘TLS_RSA_WITH_AES_256_CBC_SHA256‘,
    ‘TLS_RSA_WITH_AES_128_CBC_SHA256‘,
    ‘TLS_RSA_WITH_AES_256_CBC_SHA‘,
    ‘TLS_RSA_WITH_AES_128_CBC_SHA‘,
    ‘TLS_RSA_WITH_3DES_EDE_CBC_SHA‘
  )
}
else {
  Write-Host ‘Use cipher suites order for Windows 10/2016 and later.‘
  $cipherSuitesOrder = @(
    ‘TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384‘,
    ‘TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256‘,
    ‘TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384‘,
    ‘TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256‘,
    ‘TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA‘,
    ‘TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA‘,
    ‘TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA‘,
    ‘TLS_RSA_WITH_AES_256_GCM_SHA384‘,
    ‘TLS_RSA_WITH_AES_128_GCM_SHA256‘,
    ‘TLS_RSA_WITH_AES_256_CBC_SHA256‘,
    ‘TLS_RSA_WITH_AES_128_CBC_SHA256‘,
    ‘TLS_RSA_WITH_AES_256_CBC_SHA‘,
    ‘TLS_RSA_WITH_AES_128_CBC_SHA‘,
    ‘TLS_RSA_WITH_3DES_EDE_CBC_SHA‘
  )
}
$cipherSuitesAsString = [string]::join(‘,‘, $cipherSuitesOrder)
# One user reported this key does not exists on Windows 2012R2. Cannot repro myself on a brand new Windows 2012R2 core machine. Adding this just to be save.
New-Item ‘HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002‘ -ErrorAction SilentlyContinue
New-ItemProperty -path ‘HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002‘ -name ‘Functions‘ -value $cipherSuitesAsString -PropertyType ‘String‘ -Force | Out-Null

Write-Host ‘--------------------------------------------------------------------------------‘
Write-Host ‘NOTE: After the system has been rebooted you can verify your server‘
Write-Host ‘      configuration at https://www.ssllabs.com/ssltest/‘
Write-Host "--------------------------------------------------------------------------------`n"

Write-Host -ForegroundColor Red ‘A computer restart is required to apply settings. Restart computer now?‘
Restart-Computer -Force -Confirm

2.2 iisresetssltoweakdefaults

# Copyright 2016, Alexander Hass
# http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12
#
# Version 1.0
# - Rollback script created.

Write-Host ‘Reset IIS to weak and insecure SSL defaults...‘
Write-Host ‘--------------------------------------------------------------------------------‘

New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers‘ -Force
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CipherSuites‘ -Force
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes‘ -Force
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms‘ -Force
New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols‘ -Force

New-Item ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client‘ -Force
New-ItemProperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client‘ -name DisabledByDefault -value 1 -PropertyType ‘DWord‘

New-Item ‘HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002‘ -Force

Restart-Computer -Force


3.最后配置IIS站点，添加ssl自签名证书，站点绑定https，并选择刚添加的自签名证书即可。


4.全称无需给服务器安装证书服务，ios客户端证书校验时默认全部通过即可，如果对安全要求严格的客户端可导入证书做校验。
				


				
时间： 2024-10-17 21:33:13 

		


		


	

	
	

		


		
Windows Server 2008 R2 下配置TLS1.2，添加自签名证书的相关文章


								

		

			

                Windows Server 2008 R2 下配置证书服务器和HTTPS方式访问网站
			

		

		

									

				文章来源:http://blog.csdn.net/jiftlixu/article/details/11676081 http://www.cnblogs.com/zhongweiv/archive/2013/01/07/https.html 目录 配置环境 了解HTTPS 配置CA证书服务器 新建示例网站并发布在IIS 新建自签名证书并配置HTTPS 故障排除 其它机器无法通过访问 配置环境 Windows版本:Windows Server 2008 R2 Enterprise Servic			

		

	

				

		

			

                IIS7.0 Windows Server 2008 R2 下配置证书服务器和HTTPS方式访问网站
			

		

		

									

				配置环境 Windows版本:Windows Server 2008 R2 Enterprise Service Pack 1 系统类型: 64 位操作系统 了解HTTPS 为什么需要 HTTPS ? 在我们浏览网站时,多数网站的URL都是以HTTP开头,HTTP协议我们比较熟悉,信息通过明文传输; 使用HTTP协议有它的优点,它与服务器间传输数据更快速准确; 但是HTTP明显是不安全的,我们也可以注意到,当我们在使用邮件或者是在线支付时,都是使用HTTPS; HTTPS传输数据需要使用证书并对			

		

	

				

		

			

                如何在Windows Server 2008 R2下搭建FTP服务
			

		

		

									

				在Windows Server 2008 R2下搭建FTP服务,供客户端读取和上传文件 百度经验:jingyan.baidu.com 工具/原料 Windows Server 2008 R2 百度经验:jingyan.baidu.com 方法/步骤 1 安装FTP服务 开始-->管理工具-->服务器管理器 步骤阅读 2 安装IIS/FTP角色 打开服务器管理器,找到添加角色,然后点击,弹出添加角色对话框,选择下一步 步骤阅读 3 选择Web服务器(IIS),然后选择FTP服务,直到安装完成.			

		

	

				

		

			

                Windows Server 2008 R2下SVN服务器的搭建
			

		

		

									

				Windows Server 2008 R2下SVN服务器的搭建 一.需要软件 1.服务器端 VisualSVN-Server-3.3.1-x64 2.客户端 TortoiseSVN-1.8.11.26392-x64-svn-1.8.13 3.客户端中文语言包 LanguagePack_1.8.11.26392-x64-zh_CN 二.安装 1.安装VisualSVN-Server 1 选择visualsvn server and management: 勾选Add Subversion com			

		

	

				

		

			

                【转】Windows Server 2008 R2下安装 .net framework3.5
			

		

		

									

				原文地址:http://hi.baidu.com/tonny_dxf/item/6831bcdc3d7c06e7b2f7777c [你必须用角色管理工具安装.net framework3.5] 解决办法:服务器管理->功能->添加功能->钩上.netFramework3.5即可.(不需要framework3.5包,系统自带) 进入下一步, 点击.net Framework3.5.1功能时自动弹出2处的对话框: 选择<新增所需的功能>, 然后就会出现如下图所示的页面: 点击下一			

		

	

				

		

			

                Windows Server 2008 R2 安装配置远程桌面授权RDS
			

		

		

									

				此手册适用于Windows Server 2008 R2 系统上安装配置远程终端授权 第一步:组件添加 1.通过域账号登录服务器,打开服务器管理器,点击"添加角色" 2.勾选"远程桌面服务" 3.勾选"远程桌面会话主机"和"远程桌面授权" 4.勾选"不需要网络级别身份验证" 5.勾选"每用户" 6.不用勾选,选择下一步 7.不勾选复选框,点击下一步 8.开始安装 9.提示等待重启,重启计			

		

	

				

		

			

                Windows Server 2008 R2下将JBoss安装成windows系统服务
			

		

		

									

				JBoss版本是jboss-4.2.3.GA-jdk6.zip,操作系统是Windows Server 2008 R2. 1.系统已安装好java环境,JAVA_HOME已配置好: 2.下载所需文件.从http://www.jboss.org/jbossweb/downloads/jboss-native-2-0-10.html下载. 3.上一步下载到的文件,解压,将bin文件夹下所有文件复制到JBoss根目录的bin文件夹下. 并修改service.bat的启动内容,修改内容如下: a. 第2			

		

	

				

		

			

                cmd 执行Dcpromo错误：在该 SKU 上不支持 Active Directory 域服务安装向导，Windows Server 2008 R2 Enterprise 配置AD(Active Directory)域控制器
			

		

		

									

				今天,要安装AD域控制器,运行dcpromo结果提示:在该 SKU 上不支持 Active Directory 域服务安装向导. 以前弄的时候直接就通过了,这次咋回事?终于搞了大半天搞定了. 主要原因:我的Windows 2008 R2的版本是WEB版.不支持AD角色,只有DNS和IIS两个角色,醉了......,安装的时候说明是:web版也支持全部的角色. 只能重新安装一个Enterprise版的了: 主要说下选版本这一步: Enterprise=旗舰版,功能较全 Standard=标准版 D			

		

	

				

		

			

                在Windows Server 2008 R2下搭建jsp环境（四）-在测试的过程中可能出现的问题
			

		

		

									

				环境基本部署好了之后,便开始测试,一定要让他经得起"考验",他才会值得你的信赖.Tomcat服务器部署成功的的验证方法(默认端口的情况下): 1.loacalhost:8080 2.127.0.0.1:8080 3.主机IP:8080 注:360浏览器给的错觉是每次都能打开,其实它有"记忆"功能,一定要多刷新几次,最好使用,谷歌或火狐浏览器. 在这里我给大家分享一下,在测试的过程中可能出现的问题 测试故障1: 在tomcat中发布项目之后,用IP地址不能访问项目而用