Openssl FREAK 中間人劫持漏洞 - 解決方案

 

openssl升級步驟：

環境CentOS

 1 wget http://www.openssl.org/source/openssl-1.0.2a.tar.gz
 2 tar zxvf openssl-1.0.2a.tar.gz
 3 cd openssl-1.0.2a
 4 ./config --prefix=/usr/local/ssl
 5 make && make install
 6 mv /usr/bin/openssl /usr/bin/openssl.OFF
 7 mv /usr/include/openssl /usr/include/openssl.OFF
 8 ln –s /usr/local/ssl/bin/openssl /usr/bin/openssl
 9 ln –s /usr/local/ssl/include/openssl /usr/include/openssl
10 echo "/usr/local/ssl/lib">>/etc/ld.so.conf
11 ldconfig -v
12 openssl version -a

 

檢查是否有【Openssl FREAK 中間人劫持漏洞】命令：

openssl s_client -connect m.mash5.cn:443 -cipher EXPORT
openssl s_client -connect 121.199.43.97:443 -cipher EXPORT

 

tomcat解決方案：（tomcat用戶，推薦）

打開tomcat的配置文件server.xml，在SSL對應的<Connector>中添加下列屬性：
tomcat 5,6:
SSLEnabled="true"
sslProtocols="TLSv1,TLSv1.1,TLSv1.2"
ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA"

tomcat >=7:
SSLEnabled="true"
sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"
ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA"
修改完畢後，請重啓tomcat服務。