Website not accessible in Chrome and Firefox, when TLS 1.0 and 1.1 are disabled on IIS server

Question

We have a website which we cannot access from Chrome or Firefox, but can be accessed from IE and Edge. The problem occurs when we disable TLS 1.0 and 1.1 on the IIS server. When TLS 1.0 and 1.1 are enabled, the site can be accessed by all browsers. We have spent several days looking into this, and trying various suggested fixes. What can we do to make the site accessible even in Chrome and Firefox?

The site is a webclient for Microsoft Dynamics NAV. It is running on IIS 8.5 and Windows 2012 R2. The browsers and Windows machines all have the latest updates. We originally had a root certificate that use SHA1 as "Signature Hash Algorithm", and the website was not accessible from any browser, when TLS 1.0 and 1.1 are disabled.

We now have a certificate, and intermediate and root certificates, that all use SHA256 as "Signature Hash Algorithm", and SHA1 as thumbprint algorithm, and we can at least access the site in IE and Edge. But we still get ERR_CONNECTION_RESET in Chrome, and “Secure Connection Failed” in Firefox.

Answer 1

Can you check what your TLS options are set to in IE please? (These settings affect all browsers.. not just IE);

Just spitballing here, but if you have no options enabled in the above for TLS 1.0-1.1 and your site in IIS is set to use TLS 1.0-1.1, then Chrome/Firefox might be throwing a paddy (unable to establish secure connection etc.) when you try and connect to the site because it's not been told to use that protocol (and IIS is expecting the handshake).

I know TLS 1.0-1.1 are being deprecated and Google stopped supporting it end of Jan 2019 so it's potentially something that you will need to amend in the future anyway.