Firefox 39 – Secure Connection Failed – weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message

encryptionfirefoxSecurityssl

As of Firefox 39, connecting to an old administrative interface for some third party software gave the following message:

Secure Connection Failed

An error occurred during a connection to backup.trinetsolutions.com.
SSL received a weak ephemeral Diffie-Hellman key in Server Key
Exchange handshake message. (Error code:
ssl_error_weak_server_ephemeral_dh_key)

  • The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
  • Please contact the website owners to inform them of this problem.

Best Answer

Depending on the software, an upgrade may not be necessary.

I had this issue as well. In my case, the application was using Tomcat and I was able to change config settings in the server.xml file. I found the solution here.

To quote the relevant portion:

Tomcat has several weak ciphers enabled by default. SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message. If you have a Tomcat server (version 4.1.32 or later), you can disable SSL 2.0 and disable weak ciphers by following these instructions. Open your server.xml file add the following to your SSL connector

<connector port="443" maxhttpheadersize="8192" address="127.0.0.1" 
           enablelookups="false" disableuploadtimeout="true" acceptCount="100" 
           scheme="https" secure="true" clientAuth="false" SSLEnabled="true" 
           sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" 
           ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, 
           TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, 
           TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA, 
           TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,
           TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA" 
           keystoreFile="mydomain.key" keystorePass="changeit" 
           truststoreFile="mytruststore.truststore" truststorePass="changeit" />

In my situation, the only part that I had to modify in the server.xml file was the ciphers="..." portion.

After you do this, restart your application.

Related Question