Openssl FREAK Man-in-the-middle hijacking Vulnerability-Solution

OpenSSL upgrade steps:

Environment CentOS

1 wgethttp//www.openssl.org/source/openssl-1.0.2a.tar.gz2 TarZXVF openssl-1.0.2a.Tar. GZ3CD openssl-1.0. 2a4./config--prefix=/usr/local/SSL5  Make&& Make Install6 MV/usr/bin/openssl/usr/bin/OpenSSL. OFF7 MV/usr/include/openssl/usr/include/OpenSSL. OFF8 LN–s/usr/local/ssl/bin/openssl/usr/bin/OpenSSL9 LN–s/usr/local/ssl/include/openssl/usr/include/OpenSSLTen Echo "/usr/local/ssl/lib">>/etc/LD. so.conf OneLdconfig-v AOpenSSL version-a

Check if there is a "Openssl FREAK man-in-the-Middle Hijacking Vulnerability" command:

OpenSSL s_client-connect M.mash5.cn:443-cipher EXPORT
OpenSSL s_client-connect 121.199.43.97:443-cipher EXPORT

Tomcat Solution: (tomcat user, recommended)

Open the Tomcat profile Server.xml and add the following properties to the <Connector> for SSL:
Tomcat 5, 6:
Sslenabled= "true"
Sslprotocols= "tlsv1,tlsv1.1,tlsv1.2"
Ciphers= "tls_ecdhe_rsa_with_aes_128_cbc_sha256,tls_ecdhe_rsa_with_aes_128_cbc_sha,tls_ecdhe_rsa_with_aes_256_ CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256, tls_rsa_with_aes_128_cbc_sha,tls_rsa_with_aes_256_cbc_sha256,tls_rsa_with_aes_256_cbc_sha,ssl_rsa_with_rc4_128 _sha "

Tomcat >=7:
Sslenabled= "true"
Sslenabledprotocols= "tlsv1,tlsv1.1,tlsv1.2"
Ciphers= "tls_ecdhe_rsa_with_aes_128_cbc_sha256,tls_ecdhe_rsa_with_aes_128_cbc_sha,tls_ecdhe_rsa_with_aes_256_ CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256, tls_rsa_with_aes_128_cbc_sha,tls_rsa_with_aes_256_cbc_sha256,tls_rsa_with_aes_256_cbc_sha,ssl_rsa_with_rc4_128 _sha "
Restart the Tomcat service when you are finished modifying it.

Openssl FREAK Man-in-the-middle hijacking Vulnerability-Solution