This is related to bug 1615208. Firefox versions before this patch send *TLS* version numbers in the `supported_versions` extension for DTLS (which is incorrect), instead of *DTLS* version numbers. With that corrected, we can negotiate with Chrome, but not older versions of Firefox... Even though DTLS 1.3 disabled, negotiation is happening through `supported_versions`. The only obvious solution I see is to also advertise TLS version numbers. I have a build in-progress to verify this works.
Bug 1619102 Comment 4 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
This is related to bug 1615208. Firefox versions before this patch send *TLS* version numbers in the `supported_versions` extension for DTLS (which is incorrect), instead of *DTLS* version numbers. With that corrected, we can negotiate with Chrome, but not older versions of Firefox... Even though DTLS 1.3 disabled, negotiation is happening through `supported_versions` if it is present. The only obvious solution I see is to also advertise TLS version numbers. I have a build in-progress to verify this works.
This is related to bug 1615208. Firefox versions before this patch send *TLS* version numbers in the `supported_versions` extension for DTLS (which is incorrect), instead of *DTLS* version numbers. With that corrected, we can negotiate with Chrome, but not older versions of Firefox... Even though DTLS 1.3 disabled, negotiation is happening through `supported_versions` if it is present. The only obvious solution I see is to also advertise both TLS and DTLS version numbers. I have a build in-progress to verify this works.
This is related to bug 1615208. Firefox versions before this patch send *TLS* version numbers in the `supported_versions` extension for DTLS (which is incorrect), instead of *DTLS* version numbers. With that corrected, we can negotiate with Chrome, but not older versions of Firefox... Even though DTLS 1.3 disabled, negotiation is happening through `supported_versions` if it is present. The only obvious solution I see is to advertise both TLS and DTLS version numbers. I have a build in-progress to verify this works.