Diffie-Hellman密钥交换不足DH组强度漏洞处理

最新推荐文章于 2026-05-29 15:25:37 发布

原创最新推荐文章于 2026-05-29 15:25:37 发布 · 1.2w 阅读

6 ·

本内容遵循CC 4.0 BY-SA版权协议

标签

#java #spring boot #后端

java 专栏收录该内容

9 篇文章

订阅专栏

早些时间服务器扫描的时候报出一个漏洞，中风险 SSL/TLS：Diffie-Hellman密钥交换不足DH组强度漏洞，在漏洞说明文档中有两个参考地址：
https://weakdh.org/sysadmin.html
https://weakdh.org/
按照这两个文档说明的解决办法就是：
先在服务器上执行下面这行命令：

openssl dhparam -out dhparams.pem 2048

在这里插入图片描述

然后在tomcat里的server.xml文件配置加上

<Connector
ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_SHA,TLS_ECDHE_RSA_WITH_AES_256_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_SHA384,TLS_ECDHE_RSA_WITH_AES_256_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_128_SHA,TLS_DHE_DSS_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_256_SHA256,TLS_DHE_DSS_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_256_SHA"
/>

重启即可解决问题，但是我的项目是springboot，于是改为用配置类去解决，命令还是先执行（命令只要执行一次就行），
配置类如下（注意包别引错，我同事就就复制下面代码没复制上面的引入包导致报错）：

package com.test.config;

import org.apache.coyote.http11.AbstractHttp11Protocol;
import org.springframework.boot.web.embedded.tomcat.TomcatConnectorCustomizer;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.boot.web.server.WebServerFactoryCustomizer;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@Configuration
public class HttpsConfiguration {
    @Bean
    public WebServerFactoryCustomizer<TomcatServletWebServerFactory> servletContainerCustomizer() {
        return factory -> factory.addConnectorCustomizers((TomcatConnectorCustomizer) connector -> {
            AbstractHttp11Protocol<?> httpHandler = ((AbstractHttp11Protocol<?>) connector.getProtocolHandler());
            httpHandler.setUseServerCipherSuitesOrder("true");
            httpHandler.setSSLProtocol("TLSv1.2");
            httpHandler.setSSLHonorCipherOrder("true");
            httpHandler.setCiphers("TLS_EMPTY_RENEGOTIATION_INFO_SCSV,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384");
        });
    }
}