1629465 - Firefox should prioritize TLS 1.3 when a website supports both TLS 1.2 and TLS 1.3

Status: RESOLVED INVALID

(Core :: Security: PSM, enhancement)

Description

[Tom25519]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0

Steps to reproduce:

https://www.wikimedia.org/ is support TLS 1.3, but I visit it by Firefox, it use TLS1.2; when I visit it by Chorme, it's TLS 1.3.

Actual results:

If website support both TLS 1.3 and 1.2, should be use TLS 1.3 first. But Firefox not. For example, https://www.wikimedia.org/ is support TLS 1.3, but I visit it by Firefox, it use TLS1.2; when I visit it by Chorme, it's TLS 1.3. In Firefox for android, I couldn't know which TLS version Firefox using - maybe TLS 1.2.

Expected results:

If website support both TLS 1.3 and 1.2, should be use TLS 1.3 first.

Comment 1

[BugBot [:suhaib / :marco]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Dana Keeler (she/her) [:keeler]]

In about:config, what is the value of the preference security.tls.version.max?

Comment 3

[Andre Klapper]

As I could reproduce what's reported here, in my case in Firefox 75.0 on Fedora 31 (distro's package), the value for security.tls.version.max is 4.

Comment 4

[Dana Keeler (she/her) [:keeler]]

Can you reproduce the issue in a new profile? (Andre, I tried to need-info you but you've blocked requests in bugzilla)

Comment 5

[Andre Klapper]

Attachment: ff.jpg

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #4)

Can you reproduce the issue in a new profile?

Dana: I created a brand new profile in Firefox 75 on Fedora 31 and after clicking the lock icon in the address bar, clicking "Connection secure > ", clicking "More Information", it says TLS 1.2. See screenshot.

(Andre, I tried to need-info you but you've blocked requests in bugzilla)

That's intentional as the nagging emails are annoying. :)

Comment 6

[Dana Keeler (she/her) [:keeler]]

What is the IP address of the server you're connecting to? I'm connecting to 198.35.26.96, which is presenting a certificate issued by Let's Encrypt, not DigiCert.

Comment 7

[Tom S. (please needinfo tschuster)]

I also see TLS 1.2 and a DigiCert certificate. The IP is 91.198.174.192. I am geographically located in Germany.

Comment 8

[Dana Keeler (she/her) [:keeler]]

When I connect to that IP, I see the DigiCert certificate and TLS 1.2. Seems pretty clear these two mirrors are configured differently. This isn't a bug in Firefox.

Comment 9

[Andre Klapper]

Indeed, this should be about esams (the Wikimedia caching center in Europe) and work on TLS 1.3 is tracked in https://phabricator.wikimedia.org/T170567 (in case that the bug reporter is interested in follow-up).