VDP 6.0.1: Server has a weak ephemeral Diffie-Hellman public key

Written by Suhas Savkoor

When you deploy a 6.0.1 VDP appliance in your vCenter, you configure it by going to the VDP configuration page.

               https://<vdp_ip>:8543/vdp-configure

Then, you receive this classic message, "Server has a weak ephemeral Diffie-Hellman public key"

5 simple steps to fix this issue:

Step 1:

SSH / Open Console to the VDP Appliance.
The Username is: root
Default Password: changeme

Step 2:

Change your directory to:
# cd /usr/local/avamar-tomcat/conf/
Open server.xml
# vi server.xml

Step 3:

Locate the following lines:

<connector SSLEnabled="true" Server="Avamar" ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA" clientAuth="false" maxKeepAliveRequests="1" maxThreads="150" port="8543" maxHttpHeaderSize="32768" protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https" secure="true" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2,SSLv2Hello"/>

Step 4:

Replace them with the following lines: Press " i " to begin edit

<connector SSLEnabled="true" Server="Avamar" ciphers="TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA" clientAuth="false" maxKeepAliveRequests="1" maxThreads="150" port="8543" maxHttpHeaderSize="32768" protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https" secure="true" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2,SSLv2Hello"/>

Save changes by Pressing Esc and then :wq

Step 5:

Reboot the VDP appliance and login again to the management web page.
This time, you will be able to login to the web page without the Error.