1741025 - disabling some tls ciphers and connecting a website that needs them shows a generic network error instead of telling the user about the cipher

Status: NEW

(Firefox :: Security, enhancement)

Description

[emailsaddres]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0

Steps to reproduce:

in about:config page toggle these ciphers to false:
security.ssl3.ecdhe_rsa_aes_128_sha
security.ssl3.ecdhe_rsa_aes_256_sha
security.ssl3.rsa_aes_128_gcm_sha256
security.ssl3.rsa_aes_128_sha
security.ssl3.rsa_aes_256_gcm_sha384
security.ssl3.rsa_aes_256_sha

open this website:
https://www.blackbox.be

Actual results:

firefox shows this error

Secure Connection Failed
An error occurred during a connection to www.blackbox.be. PR_CONNECT_RESET_ERROR
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.
Learn more…

Expected results:

firefox used to tell user that they website uses a cipher that firefox doesn't support or is disabled.
it needs to do that, so that user knows it is not a network issue.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Security' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Alin Ilea, Desktop Test Engineering]

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0

Hi,

Thank you for opening this enhancement. I will set this as New and waiting for the developers opinion about it.

Thanks for your report.

Comment 3

[Daniel Veditz [:dveditz]]

Dana: is this a PSM issue (should move bug), or an issue with the error page UI (leave bug where it is)?

Comment 4

[Dana Keeler (she/her) [:keeler]]

I think it's a UI issue - the TLS error page used to detect if the user had changed any TLS-related prefs in situations like this, but either we removed that or it broke.