exchange 2010 邮件服务器owa证书更新

exchange 2010应用环境

• 四台前端服务器，两台位于DMZ区，两台位于办公网环境，办公网和DMZ的服务器做了NLB负载均衡，操作系统为windows server 2008 r2.
• 目前前端https绑定的是企业自颁发的sha1证书，加密套件为系统默认.
• 默认开启了RC4

• 使用了非安全的协议SSL_V2.0及SSL_V3.0

  更改需求

1. 将DMZ区两台服务器IIS证书替换为公网的sha256证书
2. 关闭RC4
3. 禁用SSL_V2.0及SSL_V3.0,启用TLS_V1.2，TLS_V1.1,TLS_V1.0(默认已启用)协议

4. 更新加密套件的优先顺序，配置Forward secrecy

   操作

• 购买证书
  由于公司有统一人员负责证书事宜，只提供了相关的域名，最终拿到手的是证一个私钥(private.key)及一个cer(20170928.cer)证书文件。需要将cer证书文件转为pfx类型的证书，然后导入服务器-个人区域。
  *

  openssl.exe pkcs12 -in 20170928.cer -inkey private.key -export -out server.pfx
  
  输入两次证书密码，就可以导出证书文件server.pfx

  
  
  * 需要安装完整的证书链，否则证书不能正常的使用。
• 绑定证书
  iis管理器选择刚刚导入的证书，绑定到https

• 禁用RC4
  将以下代码保存为rc4.reg并导入系统
  

   Windows Registry Editor Version 5.00
  

  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers]

  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:00000000

  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000

  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000
• 禁用ssl,启用tls
  将以下代码保存为ssl.reg并导入系统
  

  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
  
  "DisabledByDefault"=dword:00000001
  
  "Enabled"=dword:00000000
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
  
  "Enabled"=dword:00000000
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
  
  "Enabled"=dword:00000000
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
  
  "Enabled"=dword:00000000
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]
  
  "Enabled"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
  
  "Enabled"=dword:00000001
  
  "DisabledByDefault"=dword:00000000
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
  
  "Enabled"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
  
  "Enabled"=dword:00000001
  
  "DisabledByDefault"=dword:00000000

• 更新加密套件
  可以运行gpedit.smc，选择计算机-管理模板-网络-ssl密码套件 启用并将$cipherSuitesOrder的值填入，参数之间用英文状态下的逗号隔开
  

  
  
  以下为powershell脚本
  
  $cipherSuitesOrder = @(
  
  'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521',
  
  'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384',
  
  'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256',
  
  'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521',
  
  'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384',
  
  'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256',
  
  'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521',
  
  'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521',
  
  'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384',
  
  'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256',
  
  'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384',
  
  'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256',
  
  'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521',
  
  'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384',
  
  'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521',
  
  'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384',
  
  'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256',
  
  'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521',
  
  'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384',
  
  'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521',
  
  'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384',
  
  'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256',
  
  'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521',
  
  'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384',
  
  'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256',
  
  'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521',
  
  'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384',
  
  'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256',
  
  'TLS_DHE_DSS_WITH_AES_256_CBC_SHA256',
  
  'TLS_DHE_DSS_WITH_AES_256_CBC_SHA',
  
  'TLS_DHE_DSS_WITH_AES_128_CBC_SHA256',
  
  'TLS_DHE_DSS_WITH_AES_128_CBC_SHA',
  
  'TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA',
  
  'TLS_RSA_WITH_AES_256_CBC_SHA256',
  
  'TLS_RSA_WITH_AES_256_CBC_SHA',
  
  'TLS_RSA_WITH_AES_128_CBC_SHA256',
  
  'TLS_RSA_WITH_AES_128_CBC_SHA',
  
  'TLS_RSA_WITH_RC4_128_SHA',
  
  'TLS_RSA_WITH_3DES_EDE_CBC_SHA'
  
  )
  
  $cipherSuitesAsString = [string]::join(',', $cipherSuitesOrder)
  
  New-ItemProperty -path 'HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002' -name 'Functions' -value $cipherSuitesAsString -PropertyType 'String' -Force | Out-Null

转载于:https://www.cnblogs.com/-windows/p/7742089.html