Voltar
-
Título
Management Console for Unix will not load in Internet Explorer 11 saying page cannot be displayed. Firefox Secure Connection Failed -
Descrição
While loading the Management Console for Unix in Internet Explorer 11 or Edge after an update it fails to load stating 'Page Cannot Be Displayed' and indicates a server error.
When connecting through the the Management Console section of the QAS Control Center then you will see this error when trying to connect:
"Quest Management Console for Unix does not appear to be running at: https://mcu.test.org:9443/"Chrome gives "ERR_INVALID_HTTP_RESPONSEWhile loading the Management Console for Unix in Firefox or Google Chrome, after an update it fails to load with an error about the key exchange.
Secure Connection Failed -
Causa
Microsoft has disabled weak ciphers in Internet Explorer. -
Resolução
RESOLUTION:
FOR MCU VERSION 2.5.0 OR 2.5.1 ONLY:
In order to resolve this issue the underlying web server (Jetty) need to need be configured to stop accepting the weaker ciphers. This is done via the jetty.xml file.
On windows the jetty.xml file will be in this location assuming default install.
C:\Program Files (x86)\Quest Software\Management Console for Unix\etc\jetty.xml
On unix or linux it will be in this location.
/opt/quest/mcu/etc/jetty.xml
The file can be edited using notepad or vi.
Find the IncludeCipherSuites and locate the line that includes
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
This line needs to be removed and then added below 'ExcludeCipherSuites' so that it looks like the below sections.
<Set name="IncludeCipherSuites">
<Array type="java.lang.String">
<Item>TLS_DHE_DSS_WITH_AES_128_CBC_SHA</Item>
<Item>TLS_RSA_WITH_AES_128_CBC_SHA</Item>
<Item>TLS_DHE_DSS_WITH_AES_256_CBC_SHA</Item>
<Item>TLS_DHE_RSA_WITH_AES_256_CBC_SHA</Item>
<Item>TLS_RSA_WITH_AES_256_CBC_SHA</Item>
<Set name="ExcludeCipherSuites">
<Array type="java.lang.String">
<Item>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</Item>
<Item>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</Item>
<Item>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</Item>
<Item>TLS_ECDHE_RSA_WITH_NULL_SHA</Item>
<Item>TLS_ECDHE_RSA_WITH_RC4_128_SHA</Item>
<Item>TLS_DHE_RSA_WITH_AES_128_CBC_SHA</Item>
Afterwards the service will need to be restarted.
On windows machines Start > Run > services.msc find 'Quest One Management Console for Unix' then right click and select Restart.
On unix or linux the following command will restart the service.
# /opt/quest/mcu/mcu_service restart -
Informações adicionais
Firefox and Chrome may have a similar issue but notes a weak key exchange. https://support.quest.com/authentication-services/kb/155911