The other day I did a quick post about how SSL was configure for Windows Update, I thought I would double back and see if they have made any changes and it looks like they have.
From looking at the SSL Labs results I notice a few changes:
- The servers are now indicating a cipher suite preference.
- The servers are now putting TLS suites above the SSL suites.
- The servers no longer support TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA.
Since they made some changes since the post we can assume the goal was to improve things, I think they have but it doesn’t entirely make sense to me the choices they have made, for example:
- Why continue to support SSL 2.0 when no client that only supports SSL 2.0 has the WU client software on it.
- Why include more than one SSL cipher suite, if the goal is to enable the use of SSL 3.0 and the only clients to this server are based on SCHANNEL and CryptoAPI a single suite would be enough.
- If your going to support the RC4 cipher suites, why not prioritize them above the other suites so that they are resistant to BEAST.
- Why remove TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, I am guessing its performance but that is surprising since its not that much more expensive.
We also see a few changes when browsing to https://www.update.microsoft.com, unlike before when we browse from a client that doesn’t have a WU agent available on it (like XP /w IE6 and no SP) we no longer get instructions on how to get patched we now get a blank page.
Anyhow thats what I see today.
Ryan