{"id":1133,"date":"2017-04-10T15:11:49","date_gmt":"2017-04-10T15:11:49","guid":{"rendered":"http:\/\/help.sealionshipping.co.uk\/?p=1133"},"modified":"2017-04-10T15:11:49","modified_gmt":"2017-04-10T15:11:49","slug":"testing-validity-of-installed-ssl-certificate","status":"publish","type":"post","link":"http:\/\/gardiner.tech\/bluebook\/blog\/2017\/04\/10\/testing-validity-of-installed-ssl-certificate\/","title":{"rendered":"Testing Validity of Installed SSL Certificate"},"content":{"rendered":"

\t\t\t\tFrom time to time it is worth checking the validity of an SSL certificate installation for any vulnerabilities due to (for instance) – obsolete SSL Ciphers; expiry date; revocation checks; heartbeat vulnerability; etc<\/p>\n

DigiCert produce an easy tool to use to check this information.<\/p>\n

Click on digicert.com\/help<\/a> and enter the domain name or IP address to check the SSL certificate presentation.<\/p>\n

 <\/p>\n

For reference while investigating Event ID: 36887 Shannel\u00a0Error 46 alerts in the System event log (A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 46<\/em>)\u00a0we saw the following results of\u00a0incorrect cyphers for\u00a0mail.sealionshippping.co.uk<\/p>\n

\"\"<\/a><\/p>\n

Some versions of Windows Server (including Windows Server 2008 using IIS 7<\/span> & Server 2012) allow SSL 2.0 and SSL 3.0 by default. Unfortunately, these are insecure protocols and you will fail a\u00a0<\/span><\/span>PCI Compliance scan<\/a>\u00a0<\/span>if you don’t disable them. To properly secure your server and ensure that you pass your PCI-DSS scans, you will need to disable SSL 2.0, SSL 3.0 and disable weak ciphers. Other algorithms are also insecure and current ones may be deprecated in the future. Make sure to follow\u00a0<\/span><\/span>SSL Deployment Best Practices<\/a>\u00a0<\/span>when determining which protocols and ciphers to enable.<\/span><\/p>\n

The simplest way to disable and correct insecure protocols and ciphers is to use a GUI. Because Windows doesn’t provide such an interface, you’ll need to use a tool like\u00a0<\/span><\/span>Nartac’s IIS Crypto tool<\/a>\u00a0<\/span>.<\/span><\/p>\n

Checking the Exchange server with Nartac’s\u00a0IIS Crypto tool we can see we are not using SSL 2.0 or SSL 3.0 but we are using a number of obsolete RC cyphers installed by default<\/p>\n

\"\"<\/a><\/p>\n

By clicking on Best Practices button, the IIS was set\u00a0to the correct settings (as below)<\/p>\n

\"\"<\/a><\/p>\n

And now checking using\u00a0digicert.com\/help<\/span><\/u><\/a>\u00a0produces the following confirmation that the certificate is installed correctly.<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Note that the problem with TLS error that we originally investigating was not<\/strong> the result of an incorrectly installed SSL certificate but because\u00a0Mimecast\u00a0checks inbound emails against spam and viruses by using TLS to hand out the email to our server via the “Default ServerName” Receive connector.\u00a0The default FQDN setting for that connector is “servername.domain”\u00a0and this\u00a0SMTP connector has\u00a0a Self-signed Certificate for the server name only.<\/p>\n

There is no way to change the name with one using a public certificate – so we disabled the SCHANNEL Event logging completely https:\/\/support.microsoft.com\/en-us\/kb\/260729<\/a><\/p>\n

 <\/p>\n

References:-
\nEvent ID: 36887 Schannel Error 46 – Exchange 2010<\/a>
\n Troubleshooting Certificate Status and Revocation<\/a><\/p>\n

DigiCert Certificate Utility for Windows<\/h1>\n

The free DigiCert Certificate Utility for Windows is an indispensable tool for administrators and a must-have for anyone that uses SSL Certificates for Websites and servers or Code Signing Certificates for trusted software.<\/p>\n

FREE DOWNLOAD <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

From time to time it is worth checking the validity of an SSL certificate installation for any vulnerabilities due to (for instance) – obsolete SSL Ciphers; expiry date; revocation checks; heartbeat vulnerability; etc DigiCert produce an easy tool to use to check this information. Click on digicert.com\/help and enter the domain name or IP address to check the SSL certificate presentation.   For reference while investigating Event ID: 36887 Shannel\u00a0Error 46 alerts in the System […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[79],"tags":[],"_links":{"self":[{"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/posts\/1133"}],"collection":[{"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/comments?post=1133"}],"version-history":[{"count":0,"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/posts\/1133\/revisions"}],"wp:attachment":[{"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/media?parent=1133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/categories?post=1133"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gardiner.tech\/bluebook\/wp-json\/wp\/v2\/tags?post=1133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}