Setupyour IIS for SSL Perfect Forward Secrecy and TLS 1.2
https://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12
EnablingTLS 1.2 on IIS 7.5 for 256-bit cipher strength
http://jackstromberg.com/2013/09/enabling-tls-1-2-on-iis-7-5-for-256-bit-cipher-strength/
那么问题究竟出在哪呢？可能的问题，SHA256证书有问题？服务器不支持TLS1.2？然后根据Windows日志中的错误继续查找，都没能找到什么有用的信息。
于是求助朋友，朋友发来一段信息。
TLS 1.2introduced signature algorithms extension where the client advertises supportedsignature and hash algorithm combinations. When the client offers TLS1.2 without signature algorithms extension,schannel server assumes that this client only understands SHA1. If the schannelserver only has a SHA256 certificate, it will terminate the handshake. However,the same client offering TLS≤1.1 will succeed.
同时也提到了RFC5246中的一些信息。
http://www.ietf.org/rfc/rfc5246.txt
If the clientdoes not send the signature_algorithms extension, the
server MUST do the following:
- Ifthe negotiated key exchange algorithm is one of (RSA, DHE_RSA,
DH_RSA, RSA_PSK, ECDH_RSA, ECDHE_RSA),behave as if client had
sent the value {sha1,rsa}.
- Ifthe negotiated key exchange algorithm is one of (DHE_DSS,
DH_DSS), behave as if the client had sentthe value {sha1,dsa}.
- Ifthe negotiated key exchange algorithm is one of (ECDH_ECDSA,
ECDHE_ECDSA), behave as if the client hadsent value {sha1,ecdsa}.
Note: this is a change from TLS 1.1 wherethere are no explicit
rules, but as a practical matter one canassume that the peer
supports MD5 and SHA-1.
Note: this extension is not meaningful forTLS versions prior to 1.2.
Clients MUST NOT offer it if they areoffering prior versions.
However, even if clients do offer it, therules specified in [TLSEXT]
require servers to ignore extensions they donot understand.
Servers MUST NOT send this extension. TLS servers MUST support
receiving this extension.
When performing session resumption, thisextension is not included in
Server Hello, and the server ignores theextension in Client Hello
(if present).
这和我遇到的问题完全符合啊，难道是客户端没有发送签名算法扩展？于是用IE试了下访问网站，发现是可以的，于是抓包看一下，用的协议是TLS1.2。证明TLS1.2在服务器上是已经启用的了。有client hello并且服务器也回应了serverhello。
再仔细看客户端的client hello包，里面确实包含了extension信息。
