Problems connecting to webNetwork with the newest browsers.

Problem: Customer was able to connect to webnetwork 6.2 with Firefox 43 and Chrome 47 but after Firefox 44 and Chrome 48 the browser says Secure Connection Failed.

Cause: With the new browsers they have changed their security requirements. An example of one of the changes is that they started blocking sites that still allow TLS_ECDHE_RSA_WITH_RC4_128_SHA, 128 bit keys TLS 1.2.

Prerequisite(s):

webNetwork 6.2.1.186 with default denyCiphers in place.
Load Balancer that is in front of webNetwork

Solution(s): The best option is to make sure that your webNetwork is up to date. Being on the latest 6.4 code allows you to control the ciphers and protocols used by webNetwork to disable them as security requirements change with modern web browsers. If you are unable to upgrade to 6.4 then you at least have to be on 6.2.1.186 of webNetwork and update your \stoneware\config\denyciphers file. A sample of an updated one is included below. If you utilize a load balancer then consult with that vendor on how to make changes to the ciphers / protocols used.

3rd Party SSL testing sites:

Qualsys: https://www.ssllabs.com/ssltest/

You should be able to get a score of at least an A- with webNetwork 6.4.x code.

Symantic CryptoReport: https://cryptoreport.websecurity.symantec.com/checker/

Sample denyCiphers file

# A list of SSL/TLS ciphers that will be disabled when SSL is configured.

TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

Sample of excludeProtocols file (webnetwork 6.3 and higher)

# A list of protocols that will be disabled when SSL is configured.

SSLv3

SSL

SSLV2

SSLV2Hello