1485866 - Firefox nightly 63.0 can not connect to TLS v1.3 site www.tls13.net which runs OpenSSL 1.1.1-pre9

Status: RESOLVED DUPLICATE of bug 1483129

(Core :: Security: PSM, defect)

Description

[Dennis Clarke]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0
Build ID: 20180823100106

Steps to reproduce:

Attempt to reach site https://www.tls13.net/


Actual results:

Secure Connection Failed

An error occurred during a connection to www.tls13.net. Peer reports incompatible or unsupported protocol version. Error code: SSL_ERROR_PROTOCOL_VERSION_ALERT 


Expected results:

Normal page should have been displayed which worked fine with OpenSSL 1.1.1-pre7 and also OpenSSL 1.1.1-pre8 with no other changes to Apache server config.

Comment 1

[Dennis Clarke]

Seems similar to Bug 1457761 however tls13.crypto.mozilla.org may not have the same TLS v1.3 final protocol spec in place.

Comment 2

[Dennis Clarke]

Follow up from Rich Salz at openssl.org : 

    Date: Fri, 24 Aug 2018 02:12:02 +0000
    Subject: Re: [openssl-users] OpenSSL 1.1.1 pre-7 or pre-8 connect to 1.1.1
 pre-9 oddity?
    From: "Salz, Rich via openssl-users" <[e-mail]>
    
    > I find it interesting that openssl 1.1.1-pre7 can not connect to a
    > server which has openssl 1.1.1-pre9 in place. Nor can Firefox nightly.
    
    This is to be expected.  Pre-9 implements the official RFC version 
    of TLS 1.3, while the earlier beta releases implement drafts.  One
    of the major differences between the RFC and the drafts, is that
        (a) they don't interoperate, by design; and 
        (b) fallback is an error.


------ clear enough

So at this point Firefox nightly needs adjustment.

   https://www.tls13.net/   supports TLS 1.3 only.

Dennis Clarke
[e-mail]

Comment 3

[Dennis Clarke]

n.b: https://mta.openssl.org/pipermail/openssl-users/2018-August/008590.html

Comment 4

[Franziskus Kiefer [:franziskus]]

As noted in bug 1457761 comment 8 this is to expect and will change once the changes got landed.
You can follow changes to NSS in Firefox for 63 in bug 1470914.