1606734 - Disable TLS 1.0 and 1.1 by default

Status: RESOLVED FIXED

(Core :: Security: PSM, task, P1)

Description

[Martin Thomson [:mt:]]

Current plan is to disable these versions in Firefox Release version 74 unconditionally, with just the ...enable-deprecated pref and UX as a bustage-mitigation measure.

This bug tracks removal of the guards around the pref defaults for security.tls.version.min.

Comment 1

[Martin Thomson [:mt:]]

Attachment: Bug 1606734 - Disable TLS 1.0 and 1.1 by default, r?keeler

Depends on D58563

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1d07ac23cc5a
Disable TLS 1.0 and 1.1 by default, r=keeler

Comment 3

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/1d07ac23cc5a

Comment 4

[Kohei Yoshino]

Posted site compatibility note.

Comment 5

[Chris Mills [:cmills]]

Updates made on MDN concerning TLS 1.0/1.1 removal; see https://github.com/mdn/sprints/issues/2754#issuecomment-587676139 for the full details.

Let me know if there's anything else you'd like to see changed in terms of docs. Thanks!

Comment 6

[Pascal Chevrel:pascalc]

Martin, should that be also notes in our general release notes for 74?

Comment 7

[Martin Thomson [:mt:]]

Yes, it would be wise. This is a big and noticeable change, unfortunately.

Comment 8

[Pascal Chevrel:pascalc]

Could you request the addition please? Thanks
https://wiki.mozilla.org/Release_Management/Release_Notes#How_to_nominate_a_bug_for_release_notes_addition.3F

Comment 9

[Martin Thomson [:mt:]]

Release Note Request (optional, but appreciated)
[Why is this notable]: This change will result in a subset of sites becoming inaccessible, though users still have the option to re-enable TLS 1.0 in the short term. Thousands of sites will be affected.
[Affects Firefox for Android]: Yes
[Suggested wording]: Disabled TLS 1.0 and TLS 1.1. Sites that don't support TLS version 1.2 will show an error page.
[Links (documentation, blog post, etc)]: https://hacks.mozilla.org/2020/02/its-the-boot-for-tls-1-0-and-tls-1-1/ https://blog.mozilla.org/security/2018/10/15/removing-old-versions-of-tls/

Comment 10

[Pascal Chevrel:pascalc]

Note added to our 74 beta release notes, thanks.