TLS und Zertifikate für IIS konfigurieren

# IIS Crypto (Nartac Software) — empfohlene Methode
# Download: https://www.nartac.com/Products/IISCrypto
#
# 1. IIS Crypto starten
# 2. "Best Practices" Button klicken
# 3. "Apply" → Server-Neustart
#
# Best Practices deaktiviert:
# - SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1
# - RC4, DES, 3DES, MD5, NULL Ciphers
#
# Kommandozeilen-Version (für Server Core):
IISCryptoCli.exe /template best

# PowerShell — TLS-Protokolle konfigurieren (Registry)

# TLS 1.0 und 1.1 deaktivieren
foreach ($version in @('TLS 1.0', 'TLS 1.1')) {
  $serverPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$version\Server"
  $clientPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$version\Client"

  foreach ($p in @($serverPath, $clientPath)) {
    New-Item -Path $p -Force | Out-Null
    Set-ItemProperty -Path $p \
      -Name "Enabled" -Value 0 -Type DWord
    Set-ItemProperty -Path $p \
      -Name "DisabledByDefault" -Value 1 -Type DWord
  }
}

# TLS 1.2 und 1.3 explizit aktivieren
foreach ($version in @('TLS 1.2', 'TLS 1.3')) {
  $path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$version\Server"
  New-Item -Path $path -Force | Out-Null
  Set-ItemProperty -Path $path \
    -Name "Enabled" -Value 1 -Type DWord
  Set-ItemProperty -Path $path \
    -Name "DisabledByDefault" -Value 0 -Type DWord
}

Write-Host "TLS konfiguriert. Server-Neustart erforderlich!"

<!-- web.config — HTTPS erzwingen per URL Rewrite -->
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="HTTP to HTTPS"
              stopProcessing="true">
          <match url="(.*)" />
          <conditions>
            <add input="{HTTPS}"
                 pattern="off" />
          </conditions>
          <action type="Redirect"
                 url="https://{HTTP_HOST}/{R:1}"
                 redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>