I’ve recently disabled SSL2.0 support on my IIS 6.0 windows server. This is to bring the server into line with security best practices.
I’ve noticed that sites like Amazon, Google, banks, etc all have SSL2.0 support disabled.
When you browse to a secure page using Internet Explorer using only SSL2.0 you get a “Page cannot be displayed” message. I’d like to display a friendly page explaining how to turn on SSL3.0 support.
I’m guessing it’s a 403.xx code but can’t find any reference to the exact one. What is the correct code?
The rejection of SSLv2 happens during the SSL handshake, a pre-requisite for the SSL connection to be established. Since any HTTP status code or HTML error page would have to be sent using HTTP, itself being over SSL, you would first need the SSL connection to be established. This is why any fatal error at the SSL level cannot be answered to by an HTTP status code or web-page.