Have set up an SSL certificate for a new site, and in checking with the browser, the SSL states it's encrypted with 128bit encryption. I have tried with the latest versions of Chrome, IE9 and FF, all with the same result.

The certificate is from trustico - RapidSSL - which states up to 256bit is supported. This makes me think that it supports 256bit if the browser supports it.

The site is being hosted on IIS 6.

Has anybody run into this?

  • 2
    If you want to try, you could force your browser to try 256-bit cipher suites. In FF, type about:config in the location bar, filter security.ssl3 and turn off the ones with 128 or under in their names. (Make sure you don't enable weaker ones. To revert to the default, look for the values in bold/with status "user set".) Not sure if II6 would support them, though (it may depend on how it's configured). As Borealid said, AES-128 is considered good enough nowadays (or AES-256 isn't considered much stronger in fact). It's not just about the key size, the algorithm may matter too. – Bruno Jan 31 '12 at 10:39

First off, 128-bit AES is very good. The prevailing opinion is that it is secure for the future close enough to care about.

Setting that aside, the reason you're getting 128-bit encryption is because that was what was negotiated. The certificate has little to do with it; the SSL cert is an RSA keypair, and there's no way that's only 128 bits. It's more likely you're using a 2048-bit public-private pair and you just negotiated a 128-bit TLS session key.

Take a look at the server settings - IIS 6 is very dated at this point.

  • Thanks for the info - didn't really consider an IIS issue as such. Will check it out. – Franky Jan 31 '12 at 6:35
  • @Franky, it's the cipher suites, not the certificate that determine the symmetric key size. (As discussed in comments in this closed question, the days of SGC certs are over, or should be.) – Bruno Jan 31 '12 at 10:36

Encrypting something over 128bit may be "military encryption" and it's illegal by civilians. Same things about sending messages or file encryption by PGP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy