前言

2017年1月1日起App Store上的所有App应用将强制开启ATS功能。

苹果的ATS(App Transport Security)对服务器硬性3点要求：

① ATS要求TLS1.2或者更高，TLS 是 SSL 新的别称。

② 通讯中的加密套件配置要求支持列出的正向保密。

③ 数字证书必须使用sha256或者更高级的签名哈希算法，并且保证密钥是2048位及以上的RSA密钥或者256位及以上的ECC密钥。

由于领导舍不得花钱，只能辛苦我们自己搞个不花钱的证书。在网上找了一大堆各种配置证书服务的文章，在ios端运行的时候总是直接报错，很是费解，后来注意到必须是TLS1.2或者更高的版本，而按照网上的配置弄好后都是ssl1.0，根本原因没有解决。所以必须先升级服务器ssl的版本，这个升级的文章很多，有用的不多。在这里整理下找到的资料，供大家参考。注意：证书服务可以不用安装，升级ssl后即可正常访问。

1.首先打开服务器组策略，命令行输入gpedit.msc，找到ssl配置设置，双击ssl密码套件顺序，选择已启用，并保存。准备工作完成！

2.在下面选择您需要的配置并复制，打开Powershell直接粘贴。最后会提示是否重启服务器，输入Y会直接重启，根据自己的情况而定吧，重启后生效哦~

2.1. configure your IIS server with Perfect Forward Secrecy and TLS 1.2:

# Copyright 2016, Alexander Hass

# http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12

#

# Version 1.7

# - Windows Version compare failed. Get-CimInstance requires Windows 2012 or later.

# Version 1.6

# - OS version detection for cipher suites order.

# Version 1.5

# - Enabled ECDH and more secure hash functions and reorderd cipher list.

# - Added Client setting for all ciphers.

# Version 1.4

# - RC4 has been disabled.

# Version 1.3

# - MD5 has been disabled.

# Version 1.2

# - Re-factored code style and output

# Version 1.1

# - SSLv3 has been disabled. (Poodle attack protection)

Write-Host 'Configuring IIS with SSL/TLS Deployment Best Practices...'

Write-Host '--------------------------------------------------------------------------------'

# Disable Multi-Protocol Unified Hello

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'Multi-Protocol Unified Hello has been disabled.'

# Disable PCT 1.0

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'PCT 1.0 has been disabled.'

# Disable SSL 2.0 (PCI Compliance)

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'SSL 2.0 has been disabled.'

# NOTE: If you disable SSL 3.0 the you may lock out some people still using

# Windows XP with IE6/7. Without SSL 3.0 enabled, there is no protocol available

# for these people to fall back. Safer shopping certifications may require that

# you disable SSLv3.

#

# Disable SSL 3.0 (PCI Compliance) and enable "Poodle" protection

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client' -name 'DisabledByDefault' -value 1 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'SSL 3.0 has been disabled.'

# Add and Enable TLS 1.0 for client and server SCHANNEL communications

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'TLS 1.0 has been enabled.'

# Add and Enable TLS 1.1 for client and server SCHANNEL communications

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'TLS 1.1 has been enabled.'

# Add and Enable TLS 1.2 for client and server SCHANNEL communications

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -name 'DisabledByDefault' -value 0 -PropertyType 'DWord' -Force | Out-Null

Write-Host 'TLS 1.2 has been enabled.'

# Re-create the ciphers key.

New-Item 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers' -Force | Out-Null

# Disable insecure/weak ciphers.

$insecureCiphers = @(

  'DES 56/56',

  'NULL',

  'RC2 128/128',

  'RC2 40/128',

  'RC2 56/128',

  'RC4 40/128',

  'RC4 56/128',

  'RC4 64/128',

  'RC4 128/128'

)

Foreach ($insecureCipher in $insecureCiphers) {

  $key = (Get-Item HKLM:\).OpenSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers', $true).CreateSubKey($insecureCipher)

  $key.SetValue('Enabled', 0, 'DWord')

  $key.close()

  Write-Host "Weak cipher $insecureCipher has been disabled."

}

# Enable new secure ciphers.

# - RC4: It is recommended to disable RC4, but you may lock out WinXP/IE8 if you enforce this. This is a requirement for FIPS 140-2.

# - 3DES: It is recommended to disable these in near future. This is the last cipher supported by Windows XP.

# - Windows Vista and before 'Triple DES 168' was named 'Triple DES 168/168' per https://support.microsoft.com/en-us/kb/245030

$secureCiphers = @(

  'AES 128/128',

  'AES 256/256',

  'Triple DES 168'

)

Foreach ($secureCipher in $secureCiphers) {

  $key = (Get-Item HKLM:\).OpenSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers', $true).CreateSubKey($secureCipher)

  New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\$secureCipher" -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

  $key.close()

  Write-Host "Strong cipher $secureCipher has been enabled."

}

# Set hashes configuration.

New-Item 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes' -Force | Out-Null

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5' -Force | Out-Null

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5' -name Enabled -value 0 -PropertyType 'DWord' -Force | Out-Null

$secureHashes = @(

  'SHA',

  'SHA256',

  'SHA384',

  'SHA512'

)

Foreach ($secureHash in $secureHashes) {

  $key = (Get-Item HKLM:\).OpenSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes', $true).CreateSubKey($secureHash)

  New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\$secureHash" -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

  $key.close()

  Write-Host "Hash $secureHash has been enabled."

}

# Set KeyExchangeAlgorithms configuration.

New-Item 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms' -Force | Out-Null

$secureKeyExchangeAlgorithms = @(

  'Diffie-Hellman',

  'ECDH',

  'PKCS'

)

Foreach ($secureKeyExchangeAlgorithm in $secureKeyExchangeAlgorithms) {

  $key = (Get-Item HKLM:\).OpenSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms', $true).CreateSubKey($secureKeyExchangeAlgorithm)

  New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\$secureKeyExchangeAlgorithm" -name 'Enabled' -value '0xffffffff' -PropertyType 'DWord' -Force | Out-Null

  $key.close()

  Write-Host "KeyExchangeAlgorithm $secureKeyExchangeAlgorithm has been enabled."

}

# Set cipher suites order as secure as possible (Enables Perfect Forward Secrecy).

$os = Get-WmiObject -class Win32_OperatingSystem

if ([System.Version]$os.Version -lt [System.Version]'10.0') {

  Write-Host 'Use cipher suites order for Windows 2008R2/2012/2012R2.'

  $cipherSuitesOrder = @(

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256',

    'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256',

    'TLS_RSA_WITH_AES_256_GCM_SHA384',

    'TLS_RSA_WITH_AES_128_GCM_SHA256',

    'TLS_RSA_WITH_AES_256_CBC_SHA256',

    'TLS_RSA_WITH_AES_128_CBC_SHA256',

    'TLS_RSA_WITH_AES_256_CBC_SHA',

    'TLS_RSA_WITH_AES_128_CBC_SHA',

    'TLS_RSA_WITH_3DES_EDE_CBC_SHA'

  )

}

else {

  Write-Host 'Use cipher suites order for Windows 10/2016 and later.'

  $cipherSuitesOrder = @(

    'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384',

    'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256',

    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA',

    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA',

    'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256',

    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA',

    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA',

    'TLS_RSA_WITH_AES_256_GCM_SHA384',

    'TLS_RSA_WITH_AES_128_GCM_SHA256',

    'TLS_RSA_WITH_AES_256_CBC_SHA256',

    'TLS_RSA_WITH_AES_128_CBC_SHA256',

    'TLS_RSA_WITH_AES_256_CBC_SHA',

    'TLS_RSA_WITH_AES_128_CBC_SHA',

    'TLS_RSA_WITH_3DES_EDE_CBC_SHA'

  )

}

$cipherSuitesAsString = [string]::join(',', $cipherSuitesOrder)

# One user reported this key does not exists on Windows 2012R2. Cannot repro myself on a brand new Windows 2012R2 core machine. Adding this just to be save.

New-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -ErrorAction SilentlyContinue

New-ItemProperty -path 'HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -name 'Functions' -value $cipherSuitesAsString -PropertyType 'String' -Force | Out-Null

Write-Host '--------------------------------------------------------------------------------'

Write-Host 'NOTE: After the system has been rebooted you can verify your server'

Write-Host '      configuration at https://www.ssllabs.com/ssltest/'

Write-Host "--------------------------------------------------------------------------------`n"

Write-Host -ForegroundColor Red 'A computer restart is required to apply settings. Restart computer now?'

Restart-Computer -Force -Confirm

2.2 iisresetssltoweakdefaults

# Copyright 2016, Alexander Hass

# http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12

#

# Version 1.0

# - Rollback script created.

Write-Host 'Reset IIS to weak and insecure SSL defaults...'

Write-Host '--------------------------------------------------------------------------------'

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers' -Force

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CipherSuites' -Force

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes' -Force

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms' -Force

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols' -Force

New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -Force

New-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client' -name DisabledByDefault -value 1 -PropertyType 'DWord'

New-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -Force

Restart-Computer -Force
 

3.最后配置IIS站点，添加ssl自签名证书，站点绑定https，并选择刚添加的自签名证书即可。

4.全程无需给服务器安装证书服务，ios客户端证书校验时默认全部通过即可，如果对安全要求严格的客户端可导入证书做校验。

最新文章

  1. 博客迁移到GitCafe
  2. Endless Sky源码学习笔记-4
  3. reduce方法
  4. 【SQL】姗姗来迟的SQL Server 安装图解
  5. request.querystring和request.form、session的区别
  6. [React] Styling a React button component with Radium
  7. [ An Ac a Day ^_^ ] CodeForces 339A Helpful Maths
  8. 每日PA -2019年1月帖-每天更新
  9. Redis 教程 Java工程师学习知识点
  10. FTP服务与配置
  11. 用javascript判断当前是安卓平台还是ios平台
  12. Guests组里的用户和其它组里的用户相比，在系统权限上有什么不同？
  13. 前端框架VUE----vue的使用
  14. Python基础3--Python复杂数据类型
  15. vue项目在IE下报错"strict 模式下不允许一个属性有多个定义"
  16. 基于Python的轻量级RPC的实现
  17. Linux--多网卡的7种Bond模式【转】
  18. python openpyxl 2.5.4 版本 excel常用操作封装
  19. spring boot 项目文件结构
  20. Netty（六）：Netty中的连接管理（心跳机制和定时断线重连）

热门文章

  1. Angular2入门系列教程7-HTTP（一）-使用Angular2自带的http进行网络请求
  2. accept_mutex与性能的关系 (nginx)
  3. ES5对Array增强的9个API
  4. 通俗易懂的来讲讲DOM
  5. 匹夫细说C#：庖丁解牛迭代器，那些藏在幕后的秘密
  6. ADO.NET对象的详解
  7. Android数据存储之Android 6.0运行时权限下文件存储的思考
  8. JQuery 复制粘贴上传图片插件（textarea 和 tinyMCE）
  9. 【Reading Note】算法读书杂记
  10. 【走过巨坑】android studio对于jni调用及运行闪退无法加载库的问题解决方案