본 사이트는 여러분의 사용자 경험을 개선하기 위해 유지 보수를 진행하는 동안 기능이 제한됩니다. 도움말로 문제가 해결되지 않고 질문을 하고 싶다면 Twitter의 @FirefoxSupport 및 Reddit의 /r/firefox 채널을 활용하세요.

Avatar for Username

Mozilla 도움말 검색

고객 지원 사기를 피하세요. 저희는 여러분께 절대로 전화를 걸거나 문자를 보내거나 개인 정보를 공유하도록 요청하지 않습니다. "악용 사례 신고"옵션을 사용하여 의심스러운 활동을 신고해 주세요.

자세히 살펴보기

이 쓰레드는 보존되었습니다. 만약 도움이 필요하시면 새로운 질문을 올려주세요.

Why does Firefox get "SecureConnectionFailed - PR_CONNECT_ABORTED_ERROR" when connecting to website that has the SHA1 hash disabled?

SPI_help
SPI_help
more options

Security consultants have advised that cipher suites using the SHA1 hash are no longer considered secure and should not be enabled.

Using the nmap tool we can identify which cipher suites use the SHA1 hash.

On our webserver, (IIS version 8.5 on Windows 2012 R2 ) if we eliminate cipher suites that contain the SHA1 hash, the Firefox browser cannot browse the site. Error displayed = Secure Connection Failed - PR_CONNECT_ABORTED_ERROR We tested versions up to Firefox ( v75.0 ).

Other browsers such as Chrome and IE have no issues browsing our site with the SHA1 hash disabled.

Once the SHA1 hash is enabled, Firefox works fine. Seeking a solution that will satisfy the security folks and our Firefox users.

Security consultants have advised that cipher suites using the SHA1 hash are no longer considered secure and should not be enabled. Using the nmap tool we can identify which cipher suites use the SHA1 hash. On our webserver, (IIS version 8.5 on Windows 2012 R2 ) if we eliminate cipher suites that contain the SHA1 hash, the Firefox browser cannot browse the site. Error displayed = Secure Connection Failed - PR_CONNECT_ABORTED_ERROR We tested versions up to Firefox ( v75.0 ). Other browsers such as Chrome and IE have no issues browsing our site with the SHA1 hash disabled. Once the SHA1 hash is enabled, Firefox works fine. Seeking a solution that will satisfy the security folks and our Firefox users.
첨부된 스크린샷

모든 댓글 (1)

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

You can see the ones supported by Firefox by visiting this page in Firefox:

https://clienttest.ssllabs.com:8443/ssltest/viewMyClient.html

The ones in green text do not use SHA1. You'll notice 3 ciphers for TLS 1.3, then 3 ciphers for RSA (TLS_ECDHE_RSA) and 3 ciphers for ECDSA (TLS_ECDHE_ECDSA) certificates.

According to https://docs.microsoft.com/en-us/wind.../tls-cipher-suites-in-windows-8-1, you might not be able to connect using an RSA certificate: Windows Server 2012 R2 appears only to have "CBC" ciphers for SHA256 and SHA384, and Firefox only has "CBC" ciphers below that level. However, with an ECDSA certificate, there appears to be an overlap:

  • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256