How to automate cipher string list ordering with group policy?

Cipher suites can be set with a .reg file, since they have associated Registry keys and entries. See the article below.

https://support.microsoft.com/en-us/help/245030/how-to-restrict-the-use-of-certain-cryptographic-algorithms-and-protoc

What I would do is use IIS Crypto to set the cipher suites I need on the system, then export the content of the Ciphers key in a .reg file, take what I need, and use it to create a new .reg file that would be used on the targeted systems.

https://www.nartac.com/Products/IISCrypto/

Aura

Posted 2019-04-20T00:34:27.653

Reputation: 261

Good suggestion to use IIS Crypto to set it up and then export the key, however, the acceptable cipher list and it's order is not preserved when importing the schannel keys. While it does set some registry keys associated with cipher suites, I'm not so sure this ordered list is actually stored in the registry. I think it is apart of the group policy. If so, is it possible to apply this cipher list string with a simple file? – user8897013 – 2019-04-24T08:05:41.777

What do you mean by the order is not preserved? In what order do you want them? Alphabetical? Category? – Aura – 2019-04-24T19:11:53.593

Sorry for the delay here. There is an ordering for which ciphers are used first over others for compatibility (so that stronger ones can be preferred). Are you not familiar with this aspect? – user8897013 – 2019-05-08T19:29:50.067

How to automate cipher string list ordering with group policy?

Answers