An error occurred during a connection to ceqccm. Weak ephemeral DH key

Hi,

When I navigate to a CISCO Admin page for CISCO Phones on Mozilla Firefox I receive this error:


I do know how to get around it and these are the steps I use:

(1) In a new tab, type or paste about:config in the address bar and press Enter. Click the button promising to be careful.

(2) In the search box above the list, type or paste dhe and pause while the list is filtered

(3) Double-click the security.ssl3.dhe_rsa_aes_128_sha preference to switch it from true to false (disable Firefox from using this cipher)

(4) Double-click the security.ssl3.dhe_rsa_aes_256_sha preference to switch it from true to false (disable Firefox from using this cipher)

Is there any downside or vulnerabilities that will occur after doing this?

Thanks

Quite the opposite, it's good advice to do so.
Both protocols that you're disabling are from the SSL3 family, which have been proven insecure and obsolete. By disabling such protocol, you're in fact increasing your security, by not trusting a potentially insecure connection (this is why the browser complains originally).

As for the downsides, by disabling a protocol you're effectively prevented of using sites that rely on those exclusively. Obviously you lose those pages, but also you cannot fall into the trap of believing a site is secure when it's actually not.

Alejandro85 said:

Quite the opposite, it's good advice to do so.
Both protocols that you're disabling are from the SSL3 family, which have been proven insecure and obsolete. By disabling such protocol, you're in fact increasing your security, by not trusting a potentially insecure connection (this is why the browser complains originally).

As for the downsides, by disabling a protocol you're effectively prevented of using sites that rely on those exclusively. Obviously you lose those pages, but also you cannot fall into the trap of believing a site is secure when it's actually not.

Hi,

Thanks for your reply.. wow I did not realize that increases security. Should I ALWAYS have it disabled? How do you have it?

Thanks

sinfulangle said:

Hi,

Thanks for your reply.. wow I did not realize that increases security. Should I ALWAYS have it disabled? How do you have it?

Thanks

I would simply leave it disabled permanently, until there is a strong reason to bring it back. Basically, having a broken security protocol enabled creates a false sense of security, and by disabling it you avoid that pitfall. So yes, disable it always.
I have since long forgot about SSL3, and not missed it a bit really. I've also recently begin disabling all but the newest TLS 1.2 (disabled TLS 1 and 1.1 in addition to SSL3) and so far, my web experience remains the same.