最近更新了最新版浏览器的同学是不是偶尔会遇到SSL加密协议不灵,访问不了的情况?
最典型的例子是使用FF39或38.0.2访问某些网站时报错:Error code: ssl_error_weak_server_ephemeral_dh_key
这是由于你的客户端(FF39)废弃了DHE、RC4密码,而服务器端默认使用DHE、RC4加密的密钥尝试与客户端进行通信,结果客户端就报错了。
解决办法:
1、首先你要确保你的密钥(证书)加密长度>1023bit,因为<1023bit FF会认为不安全。自签名证书的,自己去看看怎么把key size设置为1024或大于1024。如果是CA机构签名的,就需要去CA机构申请重新签名更换证书。
2、服务器SSL设置中,要disable DHE cipher suites,要disable TLSv2 TLSv3,启用TLSv1,TLSv1.1,TLSv1.2。
3、服务器SSL设置中还要明确指定可以使用的cipher suites。如果是tomcat6+JDK6,那么以下cipher suites可用:
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_ECDSA_WITH_RC4_128_SHA
TLS_ECDH_RSA_WITH_RC4_128_SHA
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
配置例子:
打开tomcat的server.xml,参考以下配置:
1
|
<
Connector
protocol
=
"org.apache.coyote.http11.Http11Protocol"
URIEncoding
=
"UTF-8"
port
=
"9090"
SSLEnabled
=
"true"
maxThreads
=
"150"
scheme
=
"https"
secure
=
"true"
clientAuth
=
"false"
protocols
=
"TLSv1,TLSv1.1,TLSv1.2"
keystoreFile
=
"k.keystore"
keystorePass
=
"a123456"
truststoreFile
=
"k.keystore"
truststorePass
=
"a123456"
ciphers
=
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_RSA_WITH_RC4_128_SHA,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA"
/>
|
参考资料:
https://developer.mozilla.org/en-US/Firefox/Releases/39/Site_Compatibility
https://weakdh.org/sysadmin.html
https://weakdh.org/logjam.html
https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
本文转自 rickqin 51CTO博客,原文链接:http://blog.51cto.com/rickqin/1682426