1727017 - universalextras.co.uk - SSL_ERROR_BAD_MAC_READ

Status: VERIFIED FIXED

(Web Compatibility :: Site Reports, defect)

Description

[Karl Dubost💡 :karlcow]

An error occurred during a connection to www.universalextras.co.uk. SSL received a record with an incorrect Message Authentication Code.

Error code: SSL_ERROR_BAD_MAC_READ

setting security.tls.version.fallback-limit to 1
doesn't solve the issue.

https://www.ssllabs.com/ssltest/analyze.html?d=universalextras.co.uk
Rating: A
This server supports TLS 1.3.

There are a lot of WEAK in TLS 1.2

Comment 1

[Karl Dubost💡 :karlcow]

kimura-san,
what do you think?

Comment 2

[Masatoshi Kimura [:emk]]

setting security.tls.version.fallback-limit to 1
doesn't solve the issue.

So this is not a TLS intelerance issue. With TLS 1.3, insecure fallback is useless due to TLS 1.3 downgrade protection.

Comment 3

[Masatoshi Kimura [:emk]]

setting security.tls.version.fallback-limit to 1

1 is not a valid value for security.tls.version.fallback-limit. Only 3 (TLS 1.2) and 4 (TLS 1.3) are valid values.

If I set security.tls.hello_downgrade_check to false and security.tls.version.fallback-limit to 3, I can access www.universalextras.co.uk. But Firefox should not require any setting changes because Chrome can access this site with TLS 1.3.

:mt, any insights?

Comment 4

[Martin Thomson [:mt:]]

This is down to the site choking on delegated credentials. Unfortunately, the presence of this extension causes the server to produce bad handshake keys, so I can't tell if it is due to the server attempting to negotiate the use of delegated credentials, or because the server is just unable to handle the unexpected extension.

Disabling security.tls.enable_delegated_credentials will fix the problem. Maybe follow up with others on the NSS team if you can discover more about why the server is unable to handle this.

(This is the first report I've heard about incompatibility with this extension, so this is notable on that basis alone.)

Comment 5

[Oana Arbuzov [:oanaarbuzov]]

The issue no longer occurs on my side. The page loads without changing any config.
https://i.imgur.com/Zp2Kr00.png

Tested with:
Browser / Version: Firefox Nightly 98.0a1 (2022-01-31), Firefox Release 96.0
Operating System: Ubuntu 20.04.2, Windows 10 Pro

Comment 6

[Oana Arbuzov [:oanaarbuzov]]

The reporter also confirmed he can't reproduce the issue.