Google detected security vulnerabilities in SSL 3.0

Google detected security vulnerabilities in SSL 3.0

Google security team members reported that a security vulnerability (PDF, known as a POODLE attack) was found in the SSL 3.0 encryption protocol, allowing attackers to calculate the plaintext content of encrypted communication. SSL 3.0 has been replaced by TLS 1.0, 1.1, and 1.2 for nearly 15 years. However, most browsers today are still backward compatible with SSL 3.0. By default, the new TLS protocol is used, however, if the handshake fails, the browser will try to use the old SSL 3.0 version. Attackers can create a handshake to trick the browser into using SSL 3.0 to establish an encrypted connection and then exploit the vulnerability to crack the encrypted content. Disabling the SSL 3.0 support of the browser can alleviate this problem, but the compatibility problem may occur again. Interestingly, Google has already removed the option to disable SSL from Chrome. Developers said they are testing to disable SSL 3.0 in Chrome and plan to remove all SSL 3.0 support from the product in the next few months.

Use SSL Certificate in HAproxy 1.5

This article permanently updates the link address: