Security

Ask something
Discussion Locked

IIS 4 allowing 56bit browser access

0 helpful
3 replies

by ronb

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have a site set up in IIS 4. I have set up a 128bit Server Certificate, and I have set the site up to Require a Secure Connection, and require 128bit level encryption. Everything works fine, with one exception. I have a user running Win98 using IE5.0 with 56bit encryption that is accessing the site. If the browser only supports 40bit encryption, it will block access. But this 56bit browser, which I didn't even know existed, is accessing the site even though I have it set to require 128. I'd really like to know why, and what to do to prevent this. Any help is appreciated.

3 replies

by insatiable

The 56bit browser may be able to access your website, but it's using your 128bit encryption that you setup on your webserver. At least I think that's how it works. I could be wrong on that....

Are you running High Encryption Pack of SP6a on theserver?

Did you try using the IIS Security "What If" tool? See Article ID: Q229694 at the knowledge base
http://support.microsoft.com

Anyway, if you have the settings in for 128bit only, you could put in a javascript check that alerts the user that they are using an older browser, and give them a link to update theirs, and then deny access.

Good luck,
Melissa

by ronb

The webserver is where you set the encryption level, and that is set up to require 128 bit. It should block access to anything less than 128bit. While it does block 40bit access, it is allowing 56bit access.

This discussion is closed to new replies.