I'm tasked to figure out how to disable SSLv3 and TLS 1.0 on SharePoint 2010 farm.
After some reading, I came to the following conclusions:
- It is safe to disable SSLv3 on SharePoint servers,
- It is not possible to disable TLS 1.0, because communicatin between SharePoint servers would fail as other TLS version are not supported.
So it looks like we can't disable TLS 1.0 due to possible failure of communication between servers. I'm however thinking about scenario where we:
- don't disable TLS 1.0
- we enable TLS 1.1 and 1.2
- we configure IIS SharePoint sites to require TLS 1.1 or 1.2 on the endpoints that are publicly available
My thinking is that if we could enforce TLS 1.1 and 1.2 on the public-facing endpoints, servers between themselves could still communicate with TLS 1.0, and client could connect only with higher TLS versions.
Please let me know if what I came up with makes sense, and point me in the right direction how to configure it. In case it's not possible, please let me know what other options I have.