2

I need to connect to an HP iLO, and I get an error SSL_ERROR_BAD_MAC_ALERT when I try to connect.

The solution seems to be to disable SSL v1 and only allow v2 and v3. How can I do that on Chrome or Firefox on Mac? All the guides I find online are for windows or lead nowhere.

Improve this question
2
  • 1
    The results I've found googling point to a different, opposite, direction: TLS 1.2 in modern browsers is too new for the encryption of this old iLO. Solution seems to be updating the firmware: vcloud-lab.com/entries/windows-2016-server-r2/…
    – user931000
    Commented Aug 29, 2018 at 23:53
  • 3
    SSL v1 effectively never existed - it was introduced in 1994 and superseded later in 1994 by SSL v2. You're probably mixing up SSL and TLS: SSL 1, 2 and 3 are all ancient and superseded by the newer TLS 1.0, 1.1, 1.2 and now 1.3. You don't need to disable anything, rather, you need to enable the old SSLv3 (which is a bad idea and also impossible on modern browsers, because it exposes you to attacks from any MitM - so you need an old, iLO-only browser)
    – Bob
    Commented Aug 30, 2018 at 1:01

1 Answer 1

Reset to default
3

Most places never ever ever ever update iLO or other out of band management system unless there's new firmware. This results in fun stuff like needing three or four old versions of java and older browsers, and certs that are expired.

If there's an updated firmware it may support more modern browsers and SSL, but I wouldn't hold my breath.

The alternative is to grab an older browser just for this. This Security.SE post says that Firefox 33 Portable will work on Windows. It's going to be a minor pain if you need Java et al.

You can sometimes also run older (or newer) browsers alongside current versions - not sure how this works on a Mac, though. Basically, you need a browser that hasn't disabled SSLv3 or will let you enable it alongside your current one.

Personally, I'd rather run a full install, configured on a VM, and you can find older versions here. Configure, get it working and disable updates. However, and I've not tested this, you can also run Firefox versions side by side with a little work. Apparently this involves copying out and renaming the .app from the dmg (cool trick!), and then explicitly creating a profile using that version, and fixing up the link to it. Not tried it yet.

The VM option sounds better, since you can build an entire environment with Java versions and other prerequisites other than the browser, but your mileage may vary.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .