Chrome 45 & Firefox 39 (SSL)
Error:
Getting message ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY error in Chrome 45 & Firefox 39 while connecting OpManager in HTTPS, its because of weak cipher (lesser than 1024-bit).
P.S: The same steps can be followed for SWEET32 vulnerability where we need to disable weaker 64-bit block 3DES ciphers
Disclaimer from ManageEngine Security team
Disabling weaker ciphers will impact Internet Explorer 6, 7 and 8 users that, depending on the OS, do not support AES, and will negotiate using 3DES ciphers.
Since IE uses the cryptographic library "schannel", which is OS dependent, we need to ensure that the customer environment doesn't have older clients before disabling weaker cipher(schannel supports AES in Windows Vista, but not in Windows XP).
Solution (version 11.6 or below)
Edit ssl_server.xml from \OpManager\tomcat\conf\backup\ folder, add the below Ciphers near sslProtocol="TLS" and save the changes. Later stop and start OpManager service for the changes to take effect.
ciphers="TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
Example:
<Connector SSLEnabled="true" URIEncoding="UTF-8" acceptCount="100" address="0.0.0.0" clientAuth="false" compressableMimeType="text/html,text/xml" compression="force" compressionMinSize="1024" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" keystoreFile="WEBNMS_ROOT_DIR/conf/OPMTrans.key" keystorePass="opmanager" maxThreads="150" minSpareThreads="3" noCompressionUserAgents="gozilla, traviata" port="WEBSERVER_PORT" protocol="HTTP/1.1" scheme="https" secure="true" sslProtocol="TLS" ciphers="TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
For build 12000 and above(file location is chnaged)
Edit ssl_server.xml from \opmanager\server_xml_bkp\ folder and add the same ciphers as mentioned above. Save the file as server.xml and place it under /opmanager/conf folder.
Stop and start OpManager for the changes to take effect.
New to ADSelfService Plus?
Related Articles
Imporitng SSL certificates to OpManager
Garbled page issue when SSL is configured in OpManager
When SSL(self signed or 3rd party) is configured in OpManager, users might get garbled page sometimes. Sample error page from chrome browser. This is an issue in the current java version we use. We need to replace the file from the new version of ...Third party SSL certificate implementation in OpManager
Enabling SSL for opmanager web console using pfx or keystore or truststore
SSL Configuration steps for Version 12.3
For Build 12.3.181 and above: Steps to enable HTTPS Go to Settings Click on Basic Settings Choose "Security Settings" Enable "Secure Mode" Here you have 3 options to choose from: Generate a CSR Self-signed Certificate Import Certificate Generate ...