583914 - https://portal-plumprod.cgc.enbridge.com uses a very weak (256-bit) Diffie-Hellman key for DHE_RSA SSL cipher suites.

Status: RESOLVED FIXED

(Tech Evangelism Graveyard :: English Other, defect)

Description

[Wan-Teh Chang]

https://portal-plumprod.cgc.enbridge.com is an English site
located in Ontario, Canada.

The server uses a very weak (256-bit) Diffie-Hellman key for
DHE_RSA SSL cipher suites.  See 583337 comment 6 for the
original report of this problem.

To fix this server configuration problem, either
- use a 1024-bit Diffie-Hellman key for the DHE_RSA SSL cipher
  suites, or
- disable all DHE SSL cipher suites.

The latter may be easier to do.

Comment 1

[Boris Zbarsky [:bzbarsky]]

So... we seem to have no sane way to set blocking flags on TE bugs.  Mike, Christian, do we need to move this to Core or something?

Comment 2

[Mike Beltzner [:beltzner, not reading bugmail]]

Multi-state blocking flags require us to (ugh, christ) patch bugzilla to apply to other products. Easiest thing to do is: file a new bug in Firefox::General, set that to blocking, set it to depend on this one, grimace.

Comment 3

[Wan-Teh Chang]

https://portal-plumprod.cgc.enbridge.com has disabled all 
DHE SSL cipher suites.  Marked the bug fixed.