Management Console for Unix will not load in Firefox with error about a weak key exchange. Server has a weak ephemeral Diffie Hellman public key. (4273255)

Management Console for Unix will not load in Firefox with error about a weak key exchange. Server has a weak ephemeral Diffie Hellman public key.

While loading the Management Console for Unix in Firefox or Google Chrome, after an update it fails to load with an error about the key exchange.

Secure Connection Failed

An error occurred during a connection to mcu25.i.ts.hal.ca.qsft:9443. SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message. (Error code: ssl_error_weak_server_ephemeral_dh_key)

Firefox is no longer accepting weaker ciphers

In order to resolve this issue the underlying web server (Jetty) need to need be configured to stop accepting the weaker ciphers. This is done via the jetty.xml file.

On windows the jetty.xml file will be in this location assuming default install.
C:\Program Files (x86)\Quest Software\Management Console for Unix\etc\jetty.xml

On unix or linux it will be in this location.
/opt/quest/mcu/etc/jetty.xml


The file can be edited using notepad or vi.

Find the IncludeCipherSuites and locate the line that includes
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
This line needs to be removed and then added below 'ExcludeCipherSuites' so that it looks like the below sections.

        <Set name="IncludeCipherSuites">
          <Array type="java.lang.String">
            <Item>TLS_DHE_DSS_WITH_AES_128_CBC_SHA</Item>
            <Item>TLS_RSA_WITH_AES_128_CBC_SHA</Item>
            <Item>TLS_DHE_DSS_WITH_AES_256_CBC_SHA</Item>
            <Item>TLS_DHE_RSA_WITH_AES_256_CBC_SHA</Item>
            <Item>TLS_RSA_WITH_AES_256_CBC_SHA</Item>
            
        <Set name="ExcludeCipherSuites">
          <Array type="java.lang.String">
            <Item>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</Item>
            <Item>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</Item>
            <Item>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</Item>
            <Item>TLS_ECDHE_RSA_WITH_NULL_SHA</Item>
            <Item>TLS_ECDHE_RSA_WITH_RC4_128_SHA</Item>
            <Item>TLS_DHE_RSA_WITH_AES_128_CBC_SHA</Item>
            
Afterwards the service will need to be restarted.
On windows machines Start > Run > services.msc find 'Quest One Management Console for Unix' then right click and select Restart.
            
On unix or linux the following command will restart the service.
# /opt/quest/mcu/mcu_service restart