Service Bullettin 20150911 Weak DH HTTPS Server Keys
Contents
Service Bulletin - Chrome and Firefox drop support for servers using weak Diffie-Hellman public keys
New versions of some web borwsers have dropped support for web servers using Diffie-Hellman public keys shorter than 1024 bits.
Release Date
September 10, 2015
Affected Platforms
- Any HSYCO Server using the Java 6 virtual machine, independently of the HSYCO software version
- Google Chrome version 45
- Mozilla Firefox 39.0
Description
HSYCO uses native Java libraries, embedded in the installed Oracle Java Virtual Machine, to implement its internal HTTPS server. Java 6's HTTPS libraries use Diffie-Hellman public keys that Google and Mozilla now consider weak, after the so-called Logjam vulnerability has been discovered. This is independent of the HSYCO software version currently installed on the server.
When you try to access an HSYCO running on Java 6 via a secure HTTPS connection using the latest versions of Chrome or Firefox, the connection will not work. HTTP (not encrypted) connections are not affected by this issue.
Resolution
Both Chrome and Firefox have decided to implement these more restrictive HTTPS requirements, but failed to offer their users an option to either accept of reject a connection to a server which doesn't match these requirements.
To continue using your HSYCO, you have the following options:
- use a different browser, that still accepts Diffie-Hellman public keys generated by Java 6, like Microsoft's Internet Explorer or Apple's Safari
- implement the work-arounds that have been published on-line, and are described below
- return the HSYCO Server for service to upgrade to Java 7. Please note that you will be charged a service fee for this upgrade.
