How do I fix the CVE-2014-0224 OpenSSL vulnerability?

Question

I just scanned my site with this tool and it said my site was vulnerable to CVE-2014-0224. How do I fix it?

Do I need to get a new cert issued? The one I have I purchased from enom. Is it their fault? Or is it my web server's (webfaction's) fault?

It also says:

RC4 cipher is used with TLS 1.1 or newer protocols, even though stronger ciphers are available.

and

The server does not support Forward Secrecy with the reference browsers.

I don't know if these are all faults of the SSL cert or my server needs to support serving it correctly?

Answer 1

You need to upgrade the version of OpenSSL on your server. The vulnerability is in the software code itself.

You can read more here: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0224
or here:
http://www.openssl.org/news/secadv_20140605.txt

edit: important text is:

OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za.
OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m.
OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h.

Answer 2

CVE-2014-0224 requires an update of openssl.

RC4 cipher is used with TLS 1.1 or newer protocols, even though stronger ciphers are available.

and

The server does not support Forward Secrecy with the reference browsers.

are mere webserver configuration issues.

Something like this (assuming an apache):

SSLCertificateFile server.crt
SSLCertificateKeyFile server.key
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCompression off
# Add six earth month HSTS header for all users...
Header add Strict-Transport-Security "max-age=15768000"
# If you want to protect all subdomains, use the following header
# ALL subdomains HAVE TO support HTTPS if you use this!
# Strict-Transport-Security: max-age=15768000 ; includeSubDomains
SSLCipherSuite 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRS
A+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LO
W:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA
128-SHA:AES128-SHA'

is recommended by https://bettercrypto.org / Applied Crypto Hardening. Usage of HTTP Strict Transport Security (hsts) should be carefully judged, as it may break things, and drastically increase server load. From the security point of view, it is recommended.

Your certificate probably is fine, but if it has been used with a heartbleed exploitable version of openssl, you do have to replace it (it might be compromised).

However, upgrading openssl and configuring the webserver will require superuser privileges. If you are using shared hosting, theres nothing you can do beside asking the hosting company to fix it. And they, probably won't give a damn.