2
BETA 7269 Ciphersuite problem
Problem reported by Douglas Foster - 12/10/2019 at 8:18 AM
Submitted
After a reboot, I cannot connect to the website using HTTPS from a local browser.   Remote browsers work fine.   I created a second website with a single HTML file, and it loads in HTTPS without problem so I suspect the issue might have something to do with websockets.   Yes, I tweaked ciphersuites before the reboot that exposed the problem, and yes I have attempted to roll them back to permissive settings.   All without success.  Seems like it should be something stupid, but support directed me here since it is a Beta version.

5 Replies

Reply to Thread
0
Matt Petty Replied
Employee Post
Hello,

 What is the specific error the browser is giving you? Does it allow you to bypass?
Is this a new environment setup for testing? If so would you be able to DM me credentials?
Matt Petty Senior Software Developer SmarterTools Inc. www.smartertools.com
0
Douglas Foster Replied
IE v11:
This page can’t be displayed 
Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting to https://orchard4.bayviewphysicians.com  again. If this error persists, it is possible that this site uses an unsupported protocol or cipher suite such as RC4 (link for the details), which is not considered secure. Please contact your site administrator. 

Chrome
This site can’t be reachedThe connection was reset. Try: Checking the connection Checking the proxy and the firewall Running Windows Network Diagnostics ERR_CONNECTION_RESET

SM System Admin Security Protocols currently set to "System Defaults"

Here are the current SChannel registry settings

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL] "EventLogging"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56] "Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL] "Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128] "Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128] "Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128] "Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128] "Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128] "Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128] "Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128] "Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client] "Enabled"=dword:00000000 "DisabledByDefault"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server] "Enabled"=dword:00000000 "DisabledByDefault"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client] "DisabledByDefault"=dword:00000001 "Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server] "Enabled"=dword:00000000 "DisabledByDefault"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client] "Enabled"=dword:ffffffff "DisabledByDefault"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server] "Enabled"=dword:00000000 "DisabledByDefault"=dword:00000001
1
Matt Petty Replied
Employee Post
I was able to access your website with IE11 of HTTPS no errors, what OS is your client/browser running on?
Matt Petty Senior Software Developer SmarterTools Inc. www.smartertools.com
0
Douglas Foster Replied
Yes, I can also log on remotely.   Only the internal web browsers throw the error.   You will have to do ConnectWise session to see the problem.  I assume you have access to my contact information.
0
Douglas Foster Replied
I am suspecting that the problem is caused by a Windows update.   These have been installed:
4530689 - Dec 10, 2019 cumulative update 
4520724 - servicing stack 
4054590 - dot net 4.7.2 
4521858 - Servicing stack update 
3192137 - bundled in something else, not documented 
KB4054590 led me to this link. 
I added the suggest registry key, and rebooted, without success.   Next moves will be to build a new configuration and block windows updates.

Reply to Thread