Connection - obsolete connection settings

Question

User1556988667 posted

This is my first project with ASP.NET MVC. I get a security warning on my website that I woke up with ASP.NET MVC, the warning is:

Connection - obsolete connection settings

The connection to this site uses TLS 1.2 (a strong protocol), ECDHE_RSA with P-256 (a strong key exchange), and AES_256_CBC with HMAC-SHA1 (an obsolete cipher).

The website uses shared hosting. Can I resolve the warning without contact the hosting provider? If so, how can I fix it?

Answer 1

User-1171043462 posted

can you share which code is throwing this error?

Answer 2

User283571144 posted

Hi 6hartanto,

As far as I know, if you used chrome browser it may show this warning.

Chrome considers "modern" cipher suite as ECDHE with GCM, which isn't supported before IIS 10, which we aren't on.

I suggest you could use IISCrypto tool to help you to configure the server to eliminate obsolete SSL/TLS properties

More details, you could refer to below article:

http://blogs.technet.com/b/erezs_iis_blog/archive/2013/08/22/perfect-secrecy-in-an-imperfect-world.aspx 

https://www.nartac.com/Products/IISCrypto/Download 

Best Regards,

Brando