1159224 - ps9-web1.cna.nl.ca is is TLS 1.1/1.2 intolerant

Status: RESOLVED FIXED

(Web Compatibility :: Site Reports, defect)

Description

[markflemingnl]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Build ID: 20150415140819

Steps to reproduce:

fail to load page https://ps9-web1.cna.nl.ca
receiving ssl_error_no_cypher_overlap error
ssl settings have been updated, but receiving cipher suite mismatch on ssllabs tester


Actual results:

ssl_error_no_cypher_overlap


Expected results:

page load successfully

Comment 1

[Loic]

Because this website has only TLS 1.0 enabled, which is weak.
https://www.ssllabs.com/ssltest/analyze.html?d=ps9-web1.cna.nl.ca

Comment 2

[Loic]

reporter, could you contact the sysadmin of this website?

Comment 3

[:Cykesiopka]

(In reply to Loic from comment #1)
> Because this website has only TLS 1.0 enabled, which is weak.
> https://www.ssllabs.com/ssltest/analyze.html?d=ps9-web1.cna.nl.ca

Well, a server supporting TLS 1.0 is problematic in the longer term, but the immediate issue is that the server incorrectly chokes when something even attempts to negotiate something newer.

Comment 4

[markflemingnl]

been working with sysadmins, they have been working on fixes, however it appears recent firefox 38 update now allows the site to open.
appears related to the security.tls.insecure_fallback_hosts.use_static_list bug 1114816
if we set this to false and restart firefox, same error received.

Comment 5

[:Cykesiopka]

Looks like the site is no longer TLS 1.1/1.2 intolerant.

Note however, the "Extra download" part from https://www.ssllabs.com/ssltest/analyze.html?d=ps9-web1.cna.nl.ca:
>                  Thawte SSL CA
> 2 Extra download Fingerprint: 73e42686657aece354fbf685712361658f2f4357
>                  RSA 2048 bits (e 65537) / SHA1withRSA

This means the server is still slightly misconfigured: it should be sending this intermediate cert as well. However, this is a separate issue.

markflemingnl: thanks for working with the sysadmins to get this fixed!