Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Firefox 31 was released yesterday, and it seems like it has a problem with SSL:

Secure Connection Failed

An error occurred during a connection to api.joeyco.com. SSL peer selected a
cipher suite disallowed for the selected protocol version.
(Error code: ssl_error_cipher_disallowed_for_version)

The page you are trying to view cannot be shown because the authenticity of
the received data could not be verified.

What I tried to resolve the problem: Update to "OpenSSL 1.0.1h 5 Jun 2014", Reinstall nginx, Reinstall PHP, Regenerate certificates.

I even went through this page. What am I missing here? How can I find out for certain if nginx is actually using the correct OpenSSL?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Actually your website has a problem of using insecure SSL ciphers.

You should configure the ciphers in your web server like this:

ssl_prefer_server_ciphers On;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;

Credit for the configration goes to https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ .

You should also consider removing SSLv3 from ssl_protocols, since it is not that safe either. IE6 users running Windows XP won't be able to connect to your site if you have SSLv3 disabled.

share|improve this answer
    
Thanks! That fixed it. So which ssl_protocols do you recommend? Also when I check my site on digicert.com/help/index.htm it says still vulnerable to heartbleed, any idea why this could by. –  Samer Jul 25 at 0:33
    
I prefer to use only the TLS protocols in ssl_protocols You should open a new question on the Heartbleed issue at ServerFault. It seems that somehow your OpenSSL upgrade hasn't worked out correctly. You should provide OS & packages information in the question. –  Tero Kilkanen Jul 25 at 13:17

It is not recommended to mess with that global security setting, but add trusted hosts instead if you really need to.

See this link for information about 'Renegotiation' (CVE-2009-3555):

https://wiki.mozilla.org/Security:Renegotiation https://wiki.mozilla.org/Security:Renegotiation#security.ssl.renego_unrestricted_hosts

You can look at the security.ssl.renego_unrestricted_hosts pref on the about:config page and add the sites that you want to allow to the string value.

Separate multiple host names by a comma.

share|improve this answer
    
This doesn't really help in this case, because the server configuration problem affects all site users, and you cannot tell all site users to add things to trusted sites. –  Tero Kilkanen Jul 25 at 13:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.