Windows Server 2008 R2 下配置TLS1.2，添加自签名证书

前言

2017年1月1日起App Store上的所有App应用将强制开启ATS功能。

苹果的ATS(App Transport Security)对服务器硬性3点要求：

① ATS要求TLS1.2或者更高，TLS 是 SSL 新的别称。

② 通讯中的加密套件配置要求支持列出的正向保密。

③ 数字证书必须使用sha256或者更高级的签名哈希算法，并且保证密钥是2048位及以上的RSA密钥或者256位及以上的ECC密钥。

由于领导舍不得花钱，只能辛苦我们自己搞个不花钱的证书。在网上找了一大堆各种配置证书服务的文章，在ios端运行的时候总是直接报错，很是费解，后来注意到必须是TLS1.2或者更高的版本，而按照网上的配置弄好后都是ssl1.0，根本原因没有解决。所以必须先升级服务器ssl的版本，这个升级的文章很多，有用的不多。在这里整理下找到的资料，供大家参考。注意：证书服务可以不用安装，升级ssl后即可正常访问。

1.首先打开服务器组策略，命令行输入gpedit.msc，找到ssl配置设置，双击ssl密码套件顺序，选择已启用，并保存。准备工作完成！

2.在下面选择您需要的配置并复制，打开Powershell直接粘贴。最后会提示是否重启服务器，输入Y会直接重启，根据自己的情况而定吧，重启后生效哦~

2.1. configure your IIS server with Perfect Forward Secrecy and TLS 1.2:

# Copyright 2016, Alexander Hass

# http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12

#

# Version 1.7

# - Windows Version compare failed. Get-CimInstance requires Windows 2012 or later.

# Version 1.6

# - OS version detection for cipher suites order.

# Version 1.5

# - Enabled ECDH and more secure hash functions and reorderd cipher list.

# - Added Client setting for all ciphers.

# Version 1.4

# - RC4 has been disabled.

# Version 1.3

# - MD5 has been disabled.

# Version 1.2

# - Re-factored code style and output

# Version 1.1

# - SSLv3 has been disabled. (Poodle attack protection)

Write-Host 'Configuring IIS with SSL/TLS Deployment Best Practices...'

Write-Host '--------------------------------------------------------------------------------'

# Disable Multi-Protocol Unified Hello

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'Multi-Protocol Unified Hello has been disabled.'

# Disable PCT 1.0

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'PCT 1.0 has been disabled.'

# Disable SSL 2.0 (PCI Compliance)

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'SSL 2.0 has been disabled.'

# NOTE: If you disable SSL 3.0 the you may lock out some people still using

# Windows XP with IE6/7. Without SSL 3.0 enabled, there is no protocol available

# for these people to fall back. Safer shopping certifications may require that

# you disable SSLv3.

#

# Disable SSL 3.0 (PCI Compliance) and enable "Poodle" protection

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'SSL 3.0 has been disabled.'

# Add and Enable TLS 1.0 for client and server SCHANNEL communications

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'TLS 1.0 has been enabled.'

# Add and Enable TLS 1.1 for client and server SCHANNEL communications

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'TLS 1.1 has been enabled.'

# Add and Enable TLS 1.2 for client and server SCHANNEL communications

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'TLS 1.2 has been enabled.'

# Re-create the ciphers key.

New-Item 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers' -Force | Out-Null

# Disable insecure/weak ciphers.

$insecureCiphers = @(

  'DES 56/56',

  'NULL',

  'RC2 128/128',

  'RC2 40/128',

  'RC2 56/128',

  'RC4 40/128',

  'RC4 56/128',

  'RC4 64/128',

  'RC4 128/128'

)

Foreach ($insecureCipher in $insecureCiphers) {

  $key = (Get-Item HKLM:\).OpenSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers', $true).CreateSubKey($insecureCipher)

  $key.SetValue('Enabled', 0, 'DWord')

  $key.close()

  Write-Host "Weak cipher $insecureCipher has been disabled."

}

# Enable new secure ciphers.

# - RC4: It is recommended to disable RC4, but you may lock out WinXP/IE8 if you enforce this. This is a requirement for FIPS 140-2.

# - 3DES: It is recommended to disable these in near future. This is the last cipher supported by Windows XP.

# - Windows Vista and before 'Triple DES 168' was named 'Triple DES 168/168' per https://support.microsoft.com/en-us/kb/245030

$secureCiphers = @(

  'AES 128/128',

  'AES 256/256',

  'Triple DES 168'

)

Foreach ($secureCipher in $secureCiphers) {

  $key = (Get-Item HKLM:\).OpenSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers', $true).CreateSubKey($secureCipher)

  New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\$secureCipher" -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

  $key.close()

  Write-Host "Strong cipher $secureCipher has been enabled."

}

# Set hashes configuration.

New-Item 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

$secureHashes = @(

  'SHA',

  'SHA256',

  'SHA384',

  'SHA512'

)

Foreach ($secureHash in $secureHashes) {

  $key = (Get-Item HKLM:\).OpenSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes', $true).CreateSubKey($secureHash)

  New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\$secureHash" -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

  $key.close()

  Write-Host "Hash $secureHash has been enabled."

}

# Set KeyExchangeAlgorithms configuration.

New-Item 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms' -Force | Out-Null

$secureKeyExchangeAlgorithms = @(

  'Diffie-Hellman',

  'ECDH',

  'PKCS'

)

Foreach ($secureKeyExchangeAlgorithm in $secureKeyExchangeAlgorithms) {

  $key = (Get-Item HKLM:\).OpenSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms', $true).CreateSubKey($secureKeyExchangeAlgorithm)

  New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\$secureKeyExchangeAlgorithm" -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

  $key.close()

  Write-Host "KeyExchangeAlgorithm $secureKeyExchangeAlgorithm has been enabled."

}

# Set cipher suites order as secure as possible (Enables Perfect Forward Secrecy).

$os = Get-WmiObject -class Win32_OperatingSystem

if ([System.Version]$os.Version -lt [System.Version]'10.0') {

  Write-Host 'Use cipher suites order for Windows 2008R2/2012/2012R2.'

  $cipherSuitesOrder = @(

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256',

    'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256',

    'TLS_RSA_WITH_AES_256_GCM_SHA384',

    'TLS_RSA_WITH_AES_128_GCM_SHA256',

    'TLS_RSA_WITH_AES_256_CBC_SHA256',

    'TLS_RSA_WITH_AES_128_CBC_SHA256',

    'TLS_RSA_WITH_AES_256_CBC_SHA',

    'TLS_RSA_WITH_AES_128_CBC_SHA',

    'TLS_RSA_WITH_3DES_EDE_CBC_SHA'

  )

}

else {

  Write-Host 'Use cipher suites order for Windows 10/2016 and later.'

  $cipherSuitesOrder = @(

    'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384',

    'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA',

    'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA',

    'TLS_RSA_WITH_AES_256_GCM_SHA384',

    'TLS_RSA_WITH_AES_128_GCM_SHA256',

    'TLS_RSA_WITH_AES_256_CBC_SHA256',

    'TLS_RSA_WITH_AES_128_CBC_SHA256',

    'TLS_RSA_WITH_AES_256_CBC_SHA',

    'TLS_RSA_WITH_AES_128_CBC_SHA',

    'TLS_RSA_WITH_3DES_EDE_CBC_SHA'

  )

}

$cipherSuitesAsString = [string]::join(',', $cipherSuitesOrder)

# One user reported this key does not exists on Windows 2012R2. Cannot repro myself on a brand new Windows 2012R2 core machine. Adding this just to be save.

New-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -ErrorAction SilentlyContinue

New-ItemProperty -path 'HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -name 'Functions' -value $cipherSuitesAsString -PropertyType 'String' -Force | Out-Null

Write-Host '--------------------------------------------------------------------------------'

Write-Host 'NOTE: After the system has been rebooted you can verify your server'

Write-Host '      configuration at https://www.ssllabs.com/ssltest/'

Write-Host "--------------------------------------------------------------------------------`n"

Write-Host -ForegroundColor Red 'A computer restart is required to apply settings. Restart computer now?'

Restart-Computer -Force -Confirm

2.2 iisresetssltoweakdefaults

# Copyright 2016, Alexander Hass

# http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12

#

# Version 1.0

# - Rollback script created.

Write-Host 'Reset IIS to weak and insecure SSL defaults...'

Write-Host '--------------------------------------------------------------------------------'

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers' -Force

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CipherSuites' -Force

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes' -Force

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms' -Force

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols' -Force

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -Force

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -name DisabledByDefault -value 1 -PropertyType 'DWord'

New-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -Force

Restart-Computer -Force

3.最后配置IIS站点，添加ssl自签名证书，站点绑定https，并选择刚添加的自签名证书即可。

4.全程无需给服务器安装证书服务，ios客户端证书校验时默认全部通过即可，如果对安全要求严格的客户端可导入证书做校验。

Windows Server 2008 R2 下配置TLS1.2，添加自签名证书的更多相关文章

Windows Server 2008 R2 下配置证书服务器和HTTPS方式访问网站
http://www.cnblogs.com/zhongweiv/archive/2013/01/07/https.html 配置环境了解HTTPS 配置CA证书服务器新建示例网站并发布在IIS ...
IIS7.0 Windows Server 2008 R2 下配置证书服务器和HTTPS方式访问网站
配置环境 Windows版本:Windows Server 2008 R2 Enterprise Service Pack 1 系统类型: 64 位操作系统了解HTTPS 为什么需要 HTTPS ? ...
【服务器运维】Windows Server 2008 R2 下配置证书服务器和HTTPS
前言 2017年1月1日起App Store上的所有App应用将强制开启ATS功能. 苹果的ATS(App Transport Security)对服务器硬性3点要求: ① ATS要求TLS1.2或者 ...
如何在Windows Server 2008 R2下搭建FTP服务
在Windows Server 2008 R2下搭建FTP服务,供客户端读取和上传文件百度经验:jingyan.baidu.com 工具/原料 Windows Server 2008 R2 百度经验 ...
【转】Windows Server 2008 R2下安装 .net framework3.5
原文地址:http://hi.baidu.com/tonny_dxf/item/6831bcdc3d7c06e7b2f7777c [你必须用角色管理工具安装.net framework3.5 ...
Windows Server 2008 R2 下 Core界面
Windows Server 2008 R2 下 Core界面关于 sc 以及 net 命令 Sc 命令较不全面,仅仅是给服务发送一个开启或者关闭就结束了 Net 命令比较安全,它监视了整个服务的启 ...
cmd 执行Dcpromo错误：在该 SKU 上不支持 Active Directory 域服务安装向导，Windows Server 2008 R2 Enterprise 配置AD(Active Directory)域控制器
今天,要安装AD域控制器,运行dcpromo结果提示:在该 SKU 上不支持 Active Directory 域服务安装向导. 以前弄的时候直接就通过了,这次咋回事?终于搞了大半天搞定了. 主要原因 ...
Windows Server 2008 R2下将JBoss安装成windows系统服务
JBoss版本是jboss-4.2.3.GA-jdk6.zip,操作系统是Windows Server 2008 R2. 1.系统已安装好java环境,JAVA_HOME已配置好: 2.下载所需文件. ...
在Windows Server 2008 R2下搭建jsp环境（四）-在测试的过程中可能出现的问题
环境基本部署好了之后,便开始测试,一定要让他经得起"考验",他才会值得你的信赖.Tomcat服务器部署成功的的验证方法(默认端口的情况下): 1.loacalhost:8080 2 ...

随机推荐

C++实现线程安全的单例模式
在某些应用环境下面,一个类只允许有一个实例,这就是著名的单例模式.单例模式分为懒汉模式,跟饿汉模式两种. 首先给出饿汉模式的实现 template <class T> class sing ...
[APUE]标准IO库(下)
一.标准IO的效率对比以下四个程序的用户CPU.系统CPU与时钟时间对比程序1:系统IO 程序2:标准IO getc版本程序3:标准IO fgets版本结果: [注:该表截取自APUE,上表中 ...
SQL Server-聚焦APPLY运算符（二十七）
前言其实有些新的特性在SQL Server早就已经出现过,但是若非系统的去学习数据库你会发现在实际项目中别人的SQL其实是比较复杂的,其实利用新的SQL Server语法会更加方便和简洁,从本节开始 ...
SDWebImage源码解读之 UIImage+GIF
第二篇前言本篇是和GIF相关的一个UIImage的分类.主要提供了三个方法: + (UIImage *)sd_animatedGIFNamed:(NSString *)name ----- 根据名 ...
[转]Patch文件结构详解
N久不来于是不知道扔在哪儿于是放这里先如果你觉得碍事的话帮我扔到合适的版块去.. 导读这是一篇说明文它介绍了标准冒险岛更新文件(*.patch;*.exe)的格式文章的最后附了一段C#的参考代 ...
Lind.DDD.Aspects通过Plugins实现方法的动态拦截~Lind里的AOP
回到目录 .Net MVC之所以发展的如些之好,一个很重要原因就是它公开了一组AOP的过滤器,即使用这些过滤器可以方便的拦截controller里的action,并注入我们自己的代码逻辑,向全局的异常 ...
BPM助力企业数字化转型
自九十年代末,流程管理开始引入国内,至今已经有20多年的历史了,由最初的部门级应用向企业级应用转变,大家的认知也经历了一系列的发展变化.不同阶段的信息化水平对企业的流程以及BPM平台也提出了不同的需求 ...
Android—ListView条目背景为图片时，条目间距问题解决
ListView是android开发中使用最普遍的控件了,可有的listView条目的内容颇为丰富,甚至为了美观,背景用指定图片,如下图:
前端开发小白必学技能—非关系数据库又像关系数据库的MongoDB快速入门命令（2）
今天给大家道个歉,没有及时更新MongoDB快速入门的下篇,最近有点小忙,在此向博友们致歉.下面我将简单地说一下mongdb的一些基本命令以及我们日常开发过程中的一些问题.mongodb可以为我们提供 ...
Github使(zhuang)用(bi)指南
本文针对未能熟练使用GitHub的人员,旨在为其指明通往新世界的小路. 一些闲话可以无视在这个开源的时代,可能你听说过GitHub,知道大概是个什么.但是,你要是不能熟练的玩起来,怎么和大神取经,怎 ...

Windows Server 2008 R2 下配置TLS1.2，添加自签名证书

Windows Server 2008 R2 下配置TLS1.2，添加自签名证书的更多相关文章

随机推荐

热门专题