In a previous article, I talked about how you can get a better note on Qualys SSLLabs test, by configuring CAA DNS entry.
Today, we’ll talk about another warning most of us must resolve to get the “A” Rating.
On our AWS EC2 Windows 2012 R2 server, by default, we got that security issue from SSLLabs:
This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B.
Solution
That is caused by the Diffie-Hellman protocol accepted at 1024 bits. The fix proposed by Microsoft (article) is to still accept that protocole, but only at 2048+ bits.
You need to create 1 new registry entry. Create an empty file called df.reg, and paste that content to it:
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman] "ServerMinKeyBitLength"=dword:00000800
Then, double-click on it to apply these settings, an reboot.
Run your SSL test again, that warning disappeared.