Firefox:Secure connection failed(Error code:ssl_error_weak_server_ephemeral_dh_key)

Question

A screenshot of the problem: Browser: Firefox 39.0

Is this a problem with my browser?
How can I solve this?

Answer 1

Is this a problem with my browser?

Firefox 39 and the Firefox 31 and 38 ESR releases upgrade the TLS implementation NSS to version 3.19.1. To harden the browser against Logjam attack the minimum key length for DH parameter within the TLS handshake is now 1023 bits. But the server at acs.onlinesbi.com only uses a DH key of 768 bits. This key length is considered insecure because it might already be broken by academic research and more so by a state sponsored attacker with more computing power.

How can I solve this?

The site needs to upgrade their security. It is expected that other browsers increase the minimal required DH key length in the near future too so that the site will not be reachable by lots of users unless they improve their security.

To use the site with the current Firefox version follow the instructions below (from this MozillaZine.org forum post) to disable use of DH ciphers in Firefox:

1. In a new tab, type or paste about:config in the address bar and press Enter. Click the button promising to be careful.

2. In the search box above the list, type or paste ssl3 and pause while the list is filtered

3. Double-click the security.ssl3.dhe_rsa_aes_128_sha preference to switch it from true to false (this usually would be the first item on the list)

4. Double-click the security.ssl3.dhe_rsa_aes_256_sha preference to switch it from true to false (this usually would be the second item on the list)

   Note: A browser restart is not required. The change takes effect immediately.

This will cause FireFox to fall back to non-DH ciphers so that the weak DH key is not in use. Note that this effectively disables Forward Secrecy with sites which don't support ECDH but only DH.