13

A screenshot of the problem: enter image description here Browser: Firefox 39.0

Is this a problem with my browser?
How can I solve this?

15

Is this a problem with my browser?

Firefox 39 and the Firefox 31 and 38 ESR releases upgrade the TLS implementation NSS to version 3.19.1. To harden the browser against Logjam attack the minimum key length for DH parameter within the TLS handshake is now 1023 bits. But the server at acs.onlinesbi.com only uses a DH key of 768 bits. This key length is considered insecure because it might already be broken by academic research and more so by a state sponsored attacker with more computing power.

How can I solve this?

The site needs to upgrade their security. It is expected that other browsers increase the minimal required DH key length in the near future too so that the site will not be reachable by lots of users unless they improve their security.

To use the site with the current Firefox version follow the instructions below (from this MozillaZine.org forum post) to disable use of DH ciphers in Firefox:

  1. In a new tab, type or paste about:config in the address bar and press Enter. Click the button promising to be careful.

  2. In the search box above the list, type or paste ssl3 and pause while the list is filtered

  3. Double-click the security.ssl3.dhe_rsa_aes_128_sha preference to switch it from true to false (this usually would be the first item on the list)

  4. Double-click the security.ssl3.dhe_rsa_aes_256_sha preference to switch it from true to false (this usually would be the second item on the list)

    Note: A browser restart is not required. The change takes effect immediately.

This will cause FireFox to fall back to non-DH ciphers so that the weak DH key is not in use. Note that this effectively disables Forward Secrecy with sites which don't support ECDH but only DH.

  • @RogUE: see edit. – Steffen Ullrich Jul 5 '15 at 7:27
  • I just tried to visit the mozillazine.org site - apparently it is "down for database maintenance". The two keys I needed to change in Firefox about:config are: security.ssl3.dhe_rsa_aes_128_sha and security.ssl3.dhe_rsa_aes_256_sha – Max Vernon Sep 22 '16 at 19:45

protected by Community Jul 9 '15 at 21:36

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.