Google-chrome – Force Chrome to Ignore a “weak ephemeral Diffie-Hellman public key”

google-chromehttpsSecurity

With the update of Chrome to v45, it's blocking access to pages with weak ephermeral Diffie-Hellman public keys. I understand that this is due to Logjam. I understand that switching from https to http is a "solution" in some cases.

However, I can not switch from https to http because I am auto redirected to https by the web-based software we use on our intranet.

Obviously, the solution would be to have security change the various intranet servers to be secure from logjam, I understand that, but that isn't an option right this minute, and I can not do any more work until it's fixed. Because it's an intranet and simply connecting at all requires that one be physically here, the risk is minuscule.

Is there any way that I can continue to access pages via https protocol, with weak ephemeral Diffie-Hellman public keys in Chrome version 45?

Best Answer

Hacky fix to get around this issue (Mac OSX)

  • Run this in commandline to workaround the issue while launching Chrome

Chrome:

open /Applications/Google\ Chrome.app --args --cipher-suite-blacklist=0x0088,0x0087,0x0039,0x0038,0x0044,0x0045,0x0066,0x0032,0x0033,0x0016,0x0013

Canary:

open /Applications/Google\ Chrome\ Canary.app --args --cipher-suite-blacklist=0x0088,0x0087,0x0039,0x0038,0x0044,0x0045,0x0066,0x0032,0x0033,0x0016,0x0013

For Firefox

  • Go to about:config
  • Search for security.ssl3.dhe_rsa_aes_128_sha and security.ssl3.dhe_rsa_aes_256_sha
  • Set them both to false.

NOTE: Permanently fix would be to update the DH key with a length > 1024