If you are an IT administrator or a network administrator running a server, your users may complain about the error code ERR_SPDY_INADEQUATE_TRANSPORT_SECURITY. You can also see this error when visiting your web portal. This error will be presented with a message
«The website of * Web address * it could be temporarily inactive or it could have been permanently moved to a new web address. «
This error will prevent you from entering the web portal. The error usually happens to Chrome users, but it can also appear in Firefox. Internet Explorer and Microsoft Edge users will not see this error.
This problem is caused by HTTP / 2. This simply means that the site started an HTTP connection / 2 but there was a negotiated crypto blacklist. Therefore, the browser has prevented access to the web portal. So, the frequent answer for this is to reorder the cipher suites to meet HTTP requirements / 2.
advice
Use SSL Labs to check your server configuration. Results from SSL Labs can help you fine-tune your settings even better. Click here to go to their official site and test the server. They also have a lot of good posts about TLS and SSL.
Method 1: utilice US Crypto 2
IIS Crypto is a tool designed for administrators. Helps enable / disable different protocols, cipher suites and hashes on your servers. It is also suitable for reordering SSL cipher suites / TLS. Since the problem is in the order of the cipher suites according to the IIS, this tool can be used to fix the problem.
IIS Crypto 2 comes with Best Practices option which helps to choose suitable cipher suites. By choosing this option, encryption will be included or excluded automatically as per HTTP2 requirements. Here are the steps to use IIS Crypto 2
-
Click here and download the version that's right for you
-
Once downloaded, install and open Crypto 2
-
Just click on the Best Practices button
-
Crypto 2 will automatically select and deselect the boxes in each column
-
Once Crypto 2 have selected the protocols, axles, proper encryption and key exchanges, click apply
-
Restart and go. I should fix the problem for you.
Note: If your cipher suites are not showing up in Crypto, make sure you have the latest version. The older version will not be able to detect everything.
Method 2: rearrange Encryptor suites
Click on here and check the HTTP requirements / 2. Make sure not to use any keys that are on the black listing. The problem usually occurs because you have to exchange a key from the blacklist. Therefore, it's just a matter of using the proper protocols and ciphers. The reordering of the cipher suites must also be done according to the HTTP requirements / 2.
Note: Don't forget to reboot after you are done with the changes, as an example, enabling and disabling cipher suites.
