0

For two years the solution on Firefox: Secure Connection Failed SSL_ERROR_BAD_MAC_ALERT worked. But no more.

Firefox gives:

Secure Connection Failed

An error occurred during a connection to mysite. SSL peer reports incorrect Message Authentication Code.

Error code: SSL_ERROR_BAD_MAC_ALERT

  • The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
  • Please contact the website owners to inform them of this problem.

But does not give an option to proceed anyway.

I tried the same with Iridium:

This site can’t be reached

The webpage at mysite might be temporarily down or it may have moved permanently to a new web address.

ERR_SSL_BAD_RECORD_MAC_ALERT

Iridium also does not give an option to "add exception".

How can I enable the unsafe cipher?

Background

I have an old printer (Xerox 6140N) that works fine. It has a web server to control the setup. Security-wise it is not a problem, as the server is not publicly accessible. I cannot change the web server, thus not upgrade it to a higher TLS-version.

I would prefer a solution like Firefox: Secure Connection Failed SSL_ERROR_BAD_MAC_ALERT so that I can lower the security for this site only - and not in general.

I simply do not understand why the browsers allow for http but not for insecure https: No matter the setup, the security of https is not lower than http. I am, however, perfectly OK with a warning that makes it clear, that this is not much better than pure http.

The printer supports these:

$ nmap --script ssl-enum-ciphers -p 443 mysite
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-05 09:02 CEST
Nmap scan report for mysite (192.168.1.314)
Host is up (0.00060s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers: 
|   SSLv3: 
|     ciphers: 
|       TLS_RSA_EXPORT_WITH_DES40_CBC_SHA - E
|       TLS_RSA_EXPORT_WITH_RC4_40_MD5 - E
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 1024) - D
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 1024) - A
|       TLS_RSA_WITH_DES_CBC_SHA (rsa 1024) - D
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 1024) - D
|       TLS_RSA_WITH_RC4_128_SHA (rsa 1024) - D
|     compressors: 
|       NULL
|     cipher preference: client
|     warnings: 
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|       64-bit block cipher DES vulnerable to SWEET32 attack
|       64-bit block cipher DES40 vulnerable to SWEET32 attack
|       Broken cipher RC4 is deprecated by RFC 7465
|       CBC-mode cipher in SSLv3 (CVE-2014-3566)
|       Ciphersuite uses MD5 for message integrity
|       Forward Secrecy not supported by any cipher
|       Weak certificate signature: SHA1
|   TLSv1.0: 
|     ciphers: 
|       TLS_RSA_EXPORT_WITH_DES40_CBC_SHA - E
|       TLS_RSA_EXPORT_WITH_RC4_40_MD5 - E
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 1024) - D
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 1024) - A
|       TLS_RSA_WITH_DES_CBC_SHA (rsa 1024) - D
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 1024) - D
|       TLS_RSA_WITH_RC4_128_SHA (rsa 1024) - D
|     compressors: 
|       NULL
|     cipher preference: client
|     warnings: 
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|       64-bit block cipher DES vulnerable to SWEET32 attack
|       64-bit block cipher DES40 vulnerable to SWEET32 attack
|       Broken cipher RC4 is deprecated by RFC 7465
|       Ciphersuite uses MD5 for message integrity
|       Forward Secrecy not supported by any cipher
|       Weak certificate signature: SHA1
|_  least strength: E

1 Answer 1

0

You'll probably need to use an older version of firefox. Newer versions are making it more difficult to connect to insecure sites, and sometimes the work-arounds they give just don't work.

Try one of the 60-series ESR versions. (https://ftp.mozilla.org/pub/firefox/releases/68.9.0esr/win64/en-US/)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.