Have set up an SSL certificate for a new site, and in checking with the browser, the SSL states it's encrypted with 128bit encryption. I have tried with the latest versions of Chrome, IE9 and FF, all with the same result.
The certificate is from trustico - RapidSSL - which states up to 256bit is supported. This makes me think that it supports 256bit if the browser supports it.
The site is being hosted on IIS 6.
Has anybody run into this?
First off, 128-bit AES is very good. The prevailing opinion is that it is secure for the future close enough to care about.
Setting that aside, the reason you're getting 128-bit encryption is because that was what was negotiated. The certificate has little to do with it; the SSL cert is an RSA keypair, and there's no way that's only 128 bits. It's more likely you're using a 2048-bit public-private pair and you just negotiated a 128-bit TLS session key.
Take a look at the server settings - IIS 6 is very dated at this point.
Encrypting something over 128bit may be "military encryption" and it's illegal by civilians. Same things about sending messages or file encryption by PGP.
about:configin the location bar, filtersecurity.ssl3and turn off the ones with128or under in their names. (Make sure you don't enable weaker ones. To revert to the default, look for the values in bold/with status "user set".) Not sure if II6 would support them, though (it may depend on how it's configured). As Borealid said, AES-128 is considered good enough nowadays (or AES-256 isn't considered much stronger in fact). It's not just about the key size, the algorithm may matter too.