Logging TLS cipher usage¶

IIS TLS logging¶

The Microsoft Secure team announced in a blog post that Windows Server 2012 R2 and Server 2016 will have the ability to enable custom logging in IIS to log negotiated TLS protocols and ciphers to the access log.

To enable the new functionality, you will need to add the following custom log fields at either the site or server level.

This can be done through IIS by adding custom logging fields:

Or you can add them directly to the applicationHost.config as custom log fields:

<logFile>
    <customFields>
        <clear />
        <add logFieldName="crypt-protocol" sourceName="CRYPT_PROTOCOL" sourceType="ServerVariable" />
        <add logFieldName="crypt-cipher" sourceName="CRYPT_CIPHER_ALG_ID" sourceType="ServerVariable" />
        <add logFieldName="crypt-hash" sourceName="CRYPT_HASH_ALG_ID" sourceType="ServerVariable" />
        <add logFieldName="crypt-keyexchange" sourceName="CRYPT_KEYEXCHANGE_ALG_ID" sourceType="ServerVariable" />
    </customFields>
</logFile>

When an HTTPS request is processed, the SSL/TLS information will be written to the log file as a hexadecimal value. You can then use the Microsoft documentation for Protocols and Ciphers in order to map the hex values to human-readable names.