1179041 - www.vpv.scddesjardins.com is TLS 1.1/1.2 intolerant (fails with ssl_error_bad_mac_read)

Status: RESOLVED FIXED

(Web Compatibility :: Site Reports, defect)

Description

[Loic]

Link: https://www.vpv.scddesjardins.com/ACS/presentation.do?lang=fr&cntry=CA&dom=FED

Log: https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2Fwww.vpv.scddesjardins.com%2FACS%2Fpresentation.do%3Flang%3Dfr%26cntry%3DCA%26dom%3DFED

Comment 1

[:Cykesiopka]

Looks like the same sort of TLS 1.1/1.2 intolerance as seen in Bug 1130472: both fail with ssl_error_bad_mac_read, both have a server signature of "IBM_HTTP_Server".

security.tls.version.max = 3 -> Fail
security.tls.version.max = 2 -> Fail
security.tls.version.max = 1 -> OK

openssl s_client -connect www.vpv.scddesjardins.com:443
> CONNECTED(00000003)
> depth=2 O = Entrust.net, OU = www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU = (c) 1999 Entrust.net Limited, CN = Entrust.net Certification Authority (2048)
> verify error:num=19:self signed certificate in certificate chain
> verify return:0
> 140477050304144:error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac:s3_pkt.c:486:

openssl s_client -connect www.vpv.scddesjardins.com:443 -no_tls1_2
> CONNECTED(00000003)
> depth=2 O = Entrust.net, OU = www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU = (c) 1999 Entrust.net Limited, CN = Entrust.net Certification Authority (2048)
> verify error:num=19:self signed certificate in certificate chain
> verify return:0
> 139868204430992:error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac:s3_pkt.c:486:

openssl s_client -connect www.vpv.scddesjardins.com:443 -no_tls1_2 -no_tls1_1
> CONNECTED(00000003)
> depth=2 O = Entrust.net, OU = www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU = (c) 1999 Entrust.net Limited, CN = Entrust.net Certification Authority (2048)
> verify error:num=19:self signed certificate in certificate chain
> verify return:0

Comment 2

[Yuhong Bao]

I wonder if it is a incorrect premaster secret version check or something else.

Comment 3

[Masatoshi Kimura [:emk]]

Fixed.