1695113 - console.aws.amazon.com no cypher overlap error

Status: RESOLVED INVALID

(Core :: Networking: DNS, defect)

Description

[Jeffrey G]

Attachment: Screenshot from 2021-02-25 22-11-46.png

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

Go to https://console.aws.amazon.com
(the only ip address I could resolve is 54.239.31.83 - but dns.google.com shows 54.239.31.91 - I could find no other address)

Actual results:

Received:
Error code: SSL_ERROR_NO_CYPHER_OVERLAP

Expected results:

The website should have loaded:
I have the following enabled: ( https://clienttest.ssllabs.com:8443/ssltest/viewMyClient.html )
LS_AES_128_GCM_SHA256 (0x1301) Forward Secrecy 128
TLS_CHACHA20_POLY1305_SHA256 (0x1303) Forward Secrecy 256
TLS_AES_256_GCM_SHA384 (0x1302) Forward Secrecy 256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9) Forward Secrecy 256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8) Forward Secrecy 256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c) Forward Secrecy 256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) Forward Secrecy 256

Comment 1

[Jeffrey G]

The above ciphers should be enough to load the website. Something is seriously wrong if I have to downgrade from the ciphers I am currently using. There is no way in the world amazon aws would not work with AT LEAST ONE of the ciphers listed above.
Test and see for yourself.
What is also strange is that I could find no other IP addresses for console.aws.amazon.com other than the two listed above.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking: DNS' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 3

[Jeffrey G]

I also have most of the experimental features enabled.

Comment 4

[Jeffrey G]

I have also left off of using Ubuntu and as of today have switched to CentOS Stream 8.

Comment 5

[Masatoshi Kimura [:emk]]

(In reply to Jeffrey G from comment #0)

The website should have loaded:
I have the following enabled: ( https://clienttest.ssllabs.com:8443/ssltest/viewMyClient.html )
LS_AES_128_GCM_SHA256 (0x1301) Forward Secrecy 128
TLS_CHACHA20_POLY1305_SHA256 (0x1303) Forward Secrecy 256
TLS_AES_256_GCM_SHA384 (0x1302) Forward Secrecy 256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9) Forward Secrecy 256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8) Forward Secrecy 256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c) Forward Secrecy 256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) Forward Secrecy 256

console.aws.amazon.com does not support any cipher suites listed above:
https://www.ssllabs.com/ssltest/analyze.html?d=console.aws.amazon.com

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH secp256r1 (eq. 3072 bits RSA) FS 128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH secp256r1 (eq. 3072 bits RSA) FS WEAK 128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH secp256r1 (eq. 3072 bits RSA) FS WEAK 128
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) WEAK 128
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) WEAK 128
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) WEAK 128

Why did you file the issue against Firefox bug tracker? Mozilla can do nothing about the AWS server configuration.

Comment 6

[Jeffrey G]

I knew of the ssllabs client test I was not familiar with the details of the ssllabs server test. If I had known it could give me that information I would have used it. My appologies.
Thank you.

Comment 7

[Jeffrey G]

I believe that the AWS console is designed to use weak security on purpose. This is apparent because all the other parts of the AWS website use higher encryption and are far more secure.

Reasons like this example are why I don't trust Amazon Web Services.

Comment 8

[Masatoshi Kimura [:emk]]

Just to reiterate: Please ask AWS support about AWS problems. Here is a completely wrong location to report AWS issues.