(ssl_error_weak_server_ephemeral_dh_key) error on ONE site (W764)- other machine (W764) does NOT have this error --difference avast/mcafee and w7 H Prem vs Pro
I have seen many reports wbout login fails for the ssl_error_weak_server_ephemeral_dh_key. This happens to me on ONE website ( local library) and ONE of my 2 W7 machines. Fails on W7/64 with McAfee and W7Pro Succeeds on W7/64 with Avast and W7 Home Premium
Just started failing in the last 2 weeks.
I have tried to read the fixes, but the information was sparse . I can get around a computer, but I don't know much about the structure of FF and I need a detailed method. Plus there are the warnings about 'logjams'. I keep coming back to one machine works and one doesn't. Both running 39.0 and settings are identical as far as I can tell -- I even tried to scan the troubleshooting info.
Thanks,
Solução escolhida
You can compare the settings of the involved prefs.
- security.ssl3.dhe_rsa_aes_128_sha
- security.ssl3.dhe_rsa_aes_256_sha
Note that the DHE cipher suites were disabled for a reason and re-enabling them will make you vulnerable for the Logjam attack. You can consider to use a separate profile with the two involved cipher suites enabled and use that profile for accessing the blocked sites.
Ler esta resposta 👍 1Todas as respostas (3)
Firefox 39 and later include a fix for the Logjam vulnerability and have disabled vulnerable DHE cipher suites that are involved with the Logjam attack.
Logjam: How Diffie-Hellman Fails in Practice:
See also:
This does not solve my issue. Firefox allows the connection on one W7 machine and disallows it on the other. Both are set up identically to the best of my knowledge.
The differences are McAffe/Avast and W7 Pro /W7 Home Prem
Both are version 39. Settings are identical
Solução escolhida
You can compare the settings of the involved prefs.
- security.ssl3.dhe_rsa_aes_128_sha
- security.ssl3.dhe_rsa_aes_256_sha
Note that the DHE cipher suites were disabled for a reason and re-enabling them will make you vulnerable for the Logjam attack. You can consider to use a separate profile with the two involved cipher suites enabled and use that profile for accessing the blocked sites.