Weak cipher suite warning since 2.5M2 #1064

radokristof · 2019-10-01T16:08:48Z

Dear community!

Other also reported that since M2 (and it is still present in M3), we usually get a long list of warnings:

2019-09-30 03:42:34.055 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_ECDH_RSA_WITH_AES_256_CBC_SHA enabled for SslContextFactory@17b090b[provider=null,keyStore=null,trustStore=null]

First I thought it is because of the new mail binding, but others reported that they don't use mail bindings and still gets these warnings. @J-N-K said it might be related to Jetty.

I know this is just a warning, but I send a log report for myself daily to quickly identify problems in my setup. This warnings makes it unreadable because I get around 600-700 warnings a day just for this.
One temporary solution might be to set logging only for ERROR for the bundle which causes this warning, but I haven't figured it out yet which bundle is causing this.

The text was updated successfully, but these errors were encountered:

wborn · 2019-10-01T17:04:24Z

Karaf 4.2.6 uses a newer Jetty version that logs these warnings when using weak cipher suites. I've fixed the warnings I saw in:

If you're using a customized jetty.xml you need to revert your changes so they are in sync with this commit. You can also use our default jetty.xml.

There can still be add-ons that use a SslContextFactory without excluding the weak cipher suites that may need a similar fix like #858.

radokristof · 2019-10-01T18:22:46Z

I didn't modified that file, I don't know why it didn't got updated when I updated to M2.
I will try to replace that file, thanks!

radokristof · 2019-10-01T18:30:09Z

The jetty.xml got updated correctly, it has the same content. So maybe another bundle is using it without excluding these suites.

Can this somehow traced back from the error which bundle is throwing this warning?

wborn · 2019-10-01T21:18:46Z

The logging does not help with pin pointing the bundle. It will most likely get logged when bundles are started so you could try pin pointing it with bundle:restart on the Karaf console.

radokristof · 2019-10-04T16:18:01Z

@wborn unfortunately this is not the case. This error happens randomly and I can't find any bundle which after its restart fires these warnings.

pacive · 2019-11-25T14:17:24Z

I get these warnings as well, in my case it seems to happen when the spotify binding refreshes it's OAuth token:

2019-11-25 15:07:09.640 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_RSA_WITH_AES_256_CBC_SHA256 enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.641 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.642 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.642 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_RSA_WITH_AES_256_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.643 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_RSA_WITH_AES_256_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.644 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.644 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_ECDH_RSA_WITH_AES_256_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.645 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.645 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_DHE_DSS_WITH_AES_256_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.646 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_RSA_WITH_AES_128_CBC_SHA256 enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.647 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.647 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.647 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_RSA_WITH_AES_128_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.648 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_RSA_WITH_AES_128_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.648 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.648 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_ECDH_RSA_WITH_AES_128_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.649 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.649 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_DHE_DSS_WITH_AES_128_CBC_SHA enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.649 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_RSA_WITH_AES_256_GCM_SHA384 enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.650 [WARN ] [ty.util.ssl.SslContextFactory.config] - Weak cipher suite TLS_RSA_WITH_AES_128_GCM_SHA256 enabled for SslContextFactory@3356100a[provider=null,keyStore=null,trustStore=null]
2019-11-25 15:07:09.807 [INFO ] [oauth2client.internal.OAuthConnector] - grant type refresh_token to URL https://accounts.spotify.com/api/token success

Not sure wether the fix should go in the oauth2client bundle or in the Spotify binding though..

radokristof · 2019-11-25T14:23:26Z

Yes I was also able to trace it down until Spotify. But I think this is something wrong in the OAuth implementation and not the Spotify binding itself...

cweitkamp · 2019-11-25T15:51:19Z

@Hilbrand As initial contributor of the Spotify Binding: Do you see these warnings too?

wborn · 2019-11-25T16:34:16Z

I see that the WebClientFactoryImpl has another method where it creates a SslContextFactory that doesn't exclude these weak ciphers:

openhab-core/bundles/org.openhab.core.io.net/src/main/java/org/eclipse/smarthome/io/net/http/internal/WebClientFactoryImpl.java

Lines 419 to 420 in abb5588

    
           String excludeCipherSuites[] = { "^.*_(MD5)$" }; 
        
           sslContextFactory.setExcludeCipherSuites(excludeCipherSuites);

So we can probably fix those warnings by adding the same excludes as in the other method:

openhab-core/bundles/org.openhab.core.io.net/src/main/java/org/eclipse/smarthome/io/net/http/internal/WebClientFactoryImpl.java

Lines 391 to 394 in abb5588

    
           // Exclude weak / insecure ciphers 
        
           sslContextFactory.addExcludeCipherSuites("^.*_(MD5|SHA|SHA1)$"); 
        
           // Exclude ciphers that don't support forward secrecy 
        
           sslContextFactory.addExcludeCipherSuites("^TLS_RSA_.*$");

radokristof · 2019-11-25T16:36:49Z

Thanks @wborn it might be this causing the warnings. Should I create a PR for this?

pacive · 2019-11-25T17:53:49Z

The method is marked as deprecated, so either way we should find where this is called from and change the caller to use private SslContextFactory createSslContextFactoryFromExtensibleTrustManager() instead?

To prevent weak cipher/protocol warnings it's better to not customize the default excluded ciphers and protocols. The MD5 ciphers have already been excluded by default since Jetty 9.3.11.v20160721. Fixes openhab#1064 Signed-off-by: Wouter Born <github@maindrain.net>

wborn · 2019-11-25T18:30:09Z

Thanks but I already made a PR @radokristof! Currently we focus on fixing/adding 2.5.0 end user functionality for the upcoming release @pacive. Deprecations don't impact end users but fixing them might cause more issues.

radokristof · 2019-11-25T18:31:03Z

Thank you! Yes I also think that we might try this first, if it solves the issue and then we can think about replacing deprecated methods...

…#1241) To prevent weak cipher/protocol warnings it's better to not customize the default excluded ciphers and protocols. The MD5 ciphers have already been excluded by default since Jetty 9.3.11.v20160721. Fixes #1064 Signed-off-by: Wouter Born <github@maindrain.net>

wborn · 2019-12-07T16:55:13Z

Did you still see any warnings with this fix @radokristof, @pacive?

radokristof · 2019-12-07T16:56:06Z

No it is gone with this fix. Thanks!

wborn · 2019-12-07T16:57:22Z

Nice to know! 😄

pacive · 2019-12-08T16:22:53Z

Nothing in my logs either!

Also-By: Christoph Weitkamp <github@christophweitkamp.de> Signed-off-by: Hilbrand Bouwkamp <hilbrand@h72.nl>

…openhab#1241) To prevent weak cipher/protocol warnings it's better to not customize the default excluded ciphers and protocols. The MD5 ciphers have already been excluded by default since Jetty 9.3.11.v20160721. Fixes openhab#1064 Signed-off-by: Wouter Born <github@maindrain.net> GitOrigin-RevId: c50766d

wborn changed the title ~~Weak chiper suite warning since 2.5M2~~ Weak cipher suite warning since 2.5M2 Oct 1, 2019

wborn mentioned this issue Nov 25, 2019

Use default SslContextFactory excludes for weak ciphers and protocols #1241

Merged

kaikreuzer closed this as completed in #1241 Nov 25, 2019

Rosi2143 pushed a commit to Rosi2143/openhab-core that referenced this issue Dec 26, 2020

[developers] Rewrite of eclipse ide documentation (openhab#1064)

2569ae3

Also-By: Christoph Weitkamp <github@christophweitkamp.de> Signed-off-by: Hilbrand Bouwkamp <hilbrand@h72.nl>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Weak cipher suite warning since 2.5M2 #1064

Weak cipher suite warning since 2.5M2 #1064

radokristof commented Oct 1, 2019

wborn commented Oct 1, 2019 •

edited

radokristof commented Oct 1, 2019 •

edited

radokristof commented Oct 1, 2019 •

edited

wborn commented Oct 1, 2019

radokristof commented Oct 4, 2019

pacive commented Nov 25, 2019 •

edited

radokristof commented Nov 25, 2019

cweitkamp commented Nov 25, 2019

wborn commented Nov 25, 2019

radokristof commented Nov 25, 2019

pacive commented Nov 25, 2019

wborn commented Nov 25, 2019

radokristof commented Nov 25, 2019

wborn commented Dec 7, 2019

radokristof commented Dec 7, 2019

wborn commented Dec 7, 2019

pacive commented Dec 8, 2019

Weak cipher suite warning since 2.5M2 #1064

Weak cipher suite warning since 2.5M2 #1064

Comments

radokristof commented Oct 1, 2019

wborn commented Oct 1, 2019 • edited

radokristof commented Oct 1, 2019 • edited

radokristof commented Oct 1, 2019 • edited

wborn commented Oct 1, 2019

radokristof commented Oct 4, 2019

pacive commented Nov 25, 2019 • edited

radokristof commented Nov 25, 2019

cweitkamp commented Nov 25, 2019

wborn commented Nov 25, 2019

radokristof commented Nov 25, 2019

pacive commented Nov 25, 2019

wborn commented Nov 25, 2019

radokristof commented Nov 25, 2019

wborn commented Dec 7, 2019

radokristof commented Dec 7, 2019

wborn commented Dec 7, 2019

pacive commented Dec 8, 2019

wborn commented Oct 1, 2019 •

edited

radokristof commented Oct 1, 2019 •

edited

radokristof commented Oct 1, 2019 •

edited

pacive commented Nov 25, 2019 •

edited