1117638 - https://jacinth.eso.yorku.ca - Firefox refuses to connect to an SSLv3 only site, other browser succeed

Status: RESOLVED FIXED

(Web Compatibility :: Site Reports, defect)

Description

[Vladan Djeric (:vladan)]

I know we dropped support for SSL3 in Firefox 34, but it looks like Firefox is the only browser refusing to connect to a site that supports SSL3 in addition to other protocols?

Site: https://jacinth.eso.yorku.ca
Supported protocols: https://www.ssllabs.com/ssltest/analyze.html?d=jacinth.eso.yorku.ca

Tested on: Windows 7 and 8, with Firefox 34 (refuses to connect) + Nightly 37 (refuses) + IE 11 (works) + Chrome 39.0 (works)

- We should contact the York University server admins to disable SSL3
- Daniel, is this behavior by Firefox expected/correct?

Comment 1

[Daniel Veditz [:dveditz]]

According to what I see on ssllabs that site supports ONLY the sslv3 protocol, no version of TLS. In that case the Firefox behavior is expected since we disabled SSLv3 in Firefox 34. York U will have to enable at least TLS 1.0 in order for Firefox to connect. If they haven't done so it could be because they have an ancient web server or load balancer that does not support newer protocols. If that's true it may not be as simple as adjusting a configuration file.

Comment 2

[Vladan Djeric (:vladan)]

Why aren't Chrome & IE also blocking these sites? Or did they push that change back to future versions?

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Looks like that's happening in Chrome 40 (soon to be released) : https://groups.google.com/a/chromium.org/forum/#!msg/security-dev/Vnhy9aKM_l4/E0G5VPlb9B4J

Comment 4

[Yuhong Bao]

Looks like IBM (Lotus) Domino, for which patches are available for 8.5 and 9.0 to enable TLS 1.0.

Comment 5

[Masatoshi Kimura [:emk]]

Same issue as bug 1107014 (old unpatched Lotus Domino)?

Comment 6

[Masatoshi Kimura [:emk]]

Removing "ssl_error_no_cypher_overlap" from the summary because it will draw unrelated bug reports.

Comment 7

[Yuhong Bao]

Yea, I think so.

Comment 8

[Masatoshi Kimura [:emk]]

Looks like the site enabled TLS 1.0.