A client of ours has run some security testing which flagged up that Tridion is still using SSLv3 in their Tridion 8.5 Production environment. They have asked whether SSLv3 fallback can be disabled.
I've done some research and it appears that leaving SSLv3 fallback enabled leaves them susceptible to the Poodle attack (further details here) - Which as discovered in 2014.
There are details on disabling SSLv3 both on IIS and Apache web servers here.
The IIS fix seems quite straightforward (a couple of Windows Registry changes). However, does anyone here have experience doing this? Were there any problems accessing the system after the change? I'm especially concerned about potential problems with older Tridion clients such as Template Builder, Content Porter, Workflow Extension for Visio, etc.
I'm mostly thinking about the Content Manager here, but also wonder whether there are any concerns about this on the Content Delivery side too. For example, how do we go about ensuring that the Discovery and Content Services have SSLv3 disabled?
