SSL troubles

[JDCast11]

I am unable to make my ePO Server and SQL server connect via SSL. This is a problem as it is required and the only way it connects is if I use the setting "never use SSL". Has anyone encountered this issue and if so, how do I fix this?

[cdinet]

KB87731 lists some issues with ssl connections.  The easiest way to resolve it is to download IISCrypto and run it on epo and sql servers, choose best practices, then reboot.  If there is a GPO that overrides any ssl settings, then they will either need to update the gpo to allow the required ciphers, or remove those systems from the gpo.

[JDCast11]

I tried the recommendations you gave but I'm still unable to get SSL to work. It works perfectly fine when I configure it to never use SSL but when I switch it to Always use SSL, I get error: Networkerror IOexception: Null

[cdinet]

Please follow kb91115 to get an nmap output from the sql and epo servers. 

[JDCast11]

So it did come down to the Ciphers being incorrect. Once I ran IISCrypto everything worked fine. Only issue I have now is the GPOs keep reverting my changes. I tried to manually input the Ciphers based off the recommendations from McAfee KB but for some reason those are not working. Is there another GPO setting I must disable? Seems like the only GPO setting for SSL is the Cipher suite order.

[cdinet]

First of all, see if there is a local security policy set - go to start, run, gpedit.msc, computer configuration, administrative templates, network, ssl configuration settings.  Double-click ssl cipher suite order and make sure that is set to not configured.

If your Active Directory admins are setting a global gpo for your systems, then you will need to get with them to exclude your server from that setting or gpo.