586645 - https://www.citylink.com.au uses a very weak (256-bit) Diffie-Hellman key for DHE_RSA SSL cipher suites.

Status: RESOLVED FIXED

(Tech Evangelism Graveyard :: English Other, defect)

Description

[Wan-Teh Chang]

https://www.citylink.com.au is an English site located in
Melbourne, Australia.

The server uses a very weak (256-bit) Diffie-Hellman key for
DHE_RSA SSL cipher suites.  See bug 583337 comment 33 for the
original report of this problem.

To fix this server configuration problem, either
- use a 1024-bit Diffie-Hellman key for the DHE_RSA SSL cipher
  suites, or
- disable all DHE SSL cipher suites.

The latter may be easier to do.

Comment 1

[Wan-Teh Chang]

I sent an email to [e-mail] and
[e-mail] about this bug.

[e-mail] bounced.

Comment 2

[Alexander L. Slovesnik]

I connected to https://www.citylink.com.au several times today and never got the weak key error.
Should this bug be closed as WORKSFORME?

Comment 3

[Chris Lawson (gone)]

Shouldn't this be FIXED, then, since there was an obvious problem at one point and that problem has since disappeared? Something like this can't spontaneously resolve itself, and it was indeed a problem.

Comment 4

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Chris, I don't care which resolution is used, but the guidelines say "Resolve a bug as FIXED if the bug has been fixed by a checkin into the Mozilla Mercurial code repository. Bugs which can no longer be reproduced should be marked WORKSFORME instead of FIXED if they can't be linked to a single checkin." -- https://developer.mozilla.org/en/What_to_do_and_what_not_to_do_in_Bugzilla

Comment 5

[Daniel C]

In tech evangelism, I think FIXED is used to mean "they fixed it because we told them about it" whereas WORKSFORME is for bugs that can no longer be reproduced but that were never in the ASSIGNED state. Perhaps this should have been assigned to wtc in comment 1. It doesn't really matter and it's unclear whether they fixed it as a result of that e-mail or not, so to save churn I'll leave it as it is now (WFM).

Comment 6

[Chris Lawson (gone)]

Daniel is correct. TE isn't like the rest of Bugzilla, because the whole point of TE is that Mozilla does not have control over the buggy code.

Comment 7

[Chris Lawson (gone)]

Although, for whatever it's worth, FIXED in TE generally means "the bug no longer exists" regardless of the site's motivation for changing their code/configuration. It doesn't really matter whether they did it as a result of TE efforts here or not; the bug is FIXED just the same ;)