1908658 - Don't fallback from H3 connection for cert errors

Status: RESOLVED FIXED

(Core :: Networking: HTTP, task, P2)

Description

[Kershaw Chang [:kershaw]]

Since most web servers use the same TLS certificate for all versions of HTTP, it makes no sense to fallback from HTTP/3 to HTTP/2 when encountering certificate errors.

Comment 1

[Kershaw Chang [:kershaw]]

Attachment: Bug 1908658 - Don't fallback to H2 for NSS errors, r=#necko

Comment 2

[Max Inden]

(In reply to Kershaw Chang [:kershaw] from comment #0)

Since most web servers use the same TLS certificate for all versions of HTTP, it makes no sense to fallback from HTTP/3 to HTTP/2 when encountering certificate errors.

To make sure I am not missing something, Lars do you have any objections skipping the fallback to HTTP/2 after HTTP/3 certificate error?

The attached patch simplifies connecting with Firefox to an HTTP/3 only server with a self-signed certificate (see related issue on Neqo https://github.com/mozilla/neqo/pull/1992). Instead of falling back to HTTP/3, the certificate error is presented to the user directly, with an option to trust the self-signed certificate.

Comment 3

[Lars Eggert [:lars]]

I think it makes sense to not fall back to H2 here. The fallback is meant for when H3 isn't working, because QUIC is blocked or the server doesn't support it. A cert failure is a server misconfiguration that we should IMO not hide from the user.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a65d0d12e760
Don't fallback to H2 for NSS errors, r=mxinden

Comment 5

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/a65d0d12e760