As you're no doubt aware by now, SSLv3 is now officially dead and insecure.
If your ScreenConnect UI uses SSL, visit:
https://www.ssllabs.com/ssltestEnter your URL and hit "Submit". Wait for the test to complete... it will take roughly 1 minute.
If you're vulnerable to the poodle exploit (by supporting SSLv3 with CBC ciphers and no SCSV fallback support), you'll see
It's vital you upgrade immediately.
Linux / MonoIf you use Mono under Linux, I'd suggest moving to NGINX instead. Although it's possible to tweak Mono to remove SSLv3 support, the crypto stack isn't FIPS compliant and it's lacking in many areas. NGINX has full support for OpenSSL, allowing you to disable SSLv3 in your config. If you require SCSV fallback support, you'll also need OpenSSL >= v1.0.1j. SCSV support is enabled automatically, with no changes required to your config. Instructions on configuring NGINX for Screenconnect can be found here:
http://forum.screenconne...inux--TLS-and-Nginx.aspxLinux / ApacheEdit your SSL configuration to mirror:
SSLProtocol All -SSLv2 -SSLv3
Save the file and restart apache.
Windows / IISWindows being windows, it's tricky and requires a reboot.
1. Run regedit.
2. Navigate to:
HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders \SCHANNEL\Protocols
You should already have an SSL 2.0 branch (if not, you're way out of date!!).
3. Create an SSL 3.0 branch
4. Create a "Server" key and insert a new DWORD called "Enabled" with a value of 0.
It should look like this:
5. Reboot.
--
After you've made the necessary changes, go back to
https://www.ssllabs.com/ssltest and run the test again. If all goes well, it'll look like this:
If you no longer support SSLv3 AND you support SCSV fallback protection, it'll look like this:
