741103 - Disabling SSL3 doesn't allow any SSL connections.

Status: RESOLVED DUPLICATE of bug 672836

(Core :: Security: PSM, defect)

Description

[Kurt Roeckx]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.2) Gecko/20100101 Firefox/10.0.2 Iceweasel/10.0.2
Build ID: 20120217174734

Steps to reproduce:

I disabled SSL 3.0 support, but kept TLS 1.0 enabled.


Actual results:

Connecting to some sites doesn't work, and I get the following error:
Secure Connection Failed
An error occurred during a connection to encrypted.google.com.
Can't connect securely because the SSL protocol has been disabled.
(Error code: ssl_error_ssl_disabled)

Example sites include https://encrypted.google.com/

If I temporary enable SSL 3.0 again, and connect then, and then disable things again it works.

This seems to look a lot like bug 368130

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Either the sites don't support TLS 1.0 and only support SSL 3.0 (in which case, they won't work because you've disabled SSL 3.0), or this is bug 672836.

Comment 2

[Kurt Roeckx]

I don't see this error message anymore. I now run with SSL v3.0 disabled everywhere without issues, including on a 10.0.12.

However, that doesn't mean that this is fixed, and I'm really concerned about MITM attacks causing a downgrade to SSL v3.0.  I really see no good reason to keep using SSL v3.0.