Disabling the Weak Ciphers on a WINDOWS SERVER WHICH uses WCF services

Question

Our company security team is suggesting to disable the weak ciphers from a server where WCF services are hosted.

We don't have any specific application settings in our application which uses the below Ciphers, However, We are not sure whether WCF services require the below mentioned CIPHERs to work when we access the services from the client machines. Can someone please help on this.

a. Weak Cipher (TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000A), TLS_RSA_WITH_RC4_128_MD5 (0x0004) TLS_RSA_WITH_RC4_128_SHA (0x0005))
b. Protocol (SSL v3)/

Thanks in advance

Answer 1

You can and should disable the weak ciphers. WCF can use SSL if you have configured it to listen on HTTPS. In this case the client and server negotiate on the cipher to use. The client sends what it supports and the server compares that to what is enabled and then uses the "best" one. Disabling the weak ciphers on the server prevents a client from using a weak cipher that could be easily broken. There is a chance that a client that doesn't have any strong ciphers enabled will break but honestly this is a security issue that needs to be resolved anyway. It is unlikely you will run into issues because the ciphers have been around a long time so disabling the weaker one's should be harmless. If you have public facing clients then send out a notification about the change(s) and give them some time to ensure they are compliant before turning it off.

The protocol should also be disabled. In fact only TLS 1.2 is recommended. However this is a bigger change. Firstly you need to ensure you're running on a newer .NET Framework as TLS 1.2 isn't supported on older ones. If you can recompile your WCF service then you are done otherwise you need to make a change to the machine settings to allow TLS 1.2 on older code that you cannot recompile. Once that is done then you can confirm that your WCF service supports both the older and newer protocols. This is documented here.

Once you support TLS 1.2 in your service you should notify your clients that you are disabling everything besides TLS 1.2. All clients must ensure they are compatible with this protocol. Because clients can vary what is involved depends on the client software. Irrelevant this has been the recommendation for several years now so most everyone should be updated. Most online sites switch to TLS 1.2 only a while back so this is definitely something you should prioritize.

Note that changing SSL settings requires a server reboot so you will need to schedule some downtime for the changes.