2

I'm tasked to figure out how to disable SSLv3 and TLS 1.0 on SharePoint 2010 farm.

After some reading, I came to the following conclusions:

  • It is safe to disable SSLv3 on SharePoint servers,
  • It is not possible to disable TLS 1.0, because communicatin between SharePoint servers would fail as other TLS version are not supported.

So it looks like we can't disable TLS 1.0 due to possible failure of communication between servers. I'm however thinking about scenario where we:

  • don't disable TLS 1.0
  • we enable TLS 1.1 and 1.2
  • we configure IIS SharePoint sites to require TLS 1.1 or 1.2 on the endpoints that are publicly available

My thinking is that if we could enforce TLS 1.1 and 1.2 on the public-facing endpoints, servers between themselves could still communicate with TLS 1.0, and client could connect only with higher TLS versions.

Please let me know if what I came up with makes sense, and point me in the right direction how to configure it. In case it's not possible, please let me know what other options I have.

bumped to the homepage by Community 13 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

0

From what I've read and understood, SharePoint 2010, having been developed using .NET2 doesn't have support for TLS1.1 and TLS1.2 built in, so enforcing their use is likely to break at least your internal farm communications.

Test and re-test to ensure any changes you do make can be reverted easily and with minimal impact.

I should add that when I disabled SSLv3 on my test SharePoint farm, communications with the Secure Store Service from other Service Applications was failing - re-enabling it resolved the issue.

0

To anybody reading this post after 2016 - it IS possible to enable only TLS 1.2 and disable the others (TLS 1.0 , TLS 1.1 , SSL 3.0). Please follow MS official guide how to do it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.