Behavior for security.tls.version.fallback, max and min
Hi folks, I have a question about this combination in config: security.tls.version.fallback-limit = 3
security.tls.version.max = 3
security.tls.version.min = 1
All of those are default in FF 48.0.2 .
According to KB, FF should allow TLS 1.0, 1.1 and 1.2, and fallback is not allowed from TLS 1.2.
Here is my question: if the server only supports TLS 1.0, what will FF do? Refuse it or happily connect to the server?
由DSakura于修改
被采纳的解决方案
Firefox 48 can connect with servers that only advertise support for TLS 1.0 (assuming they use a valid certificate and ciphers that Firefox considers acceptable).
"Fallback" is a process where the server advertises support for TLS 1.2 but Firefox is unable to connect using TLS 1.2 for some reason, so Firefox used to try TLS 1.1, 1.0, even SSLv3. Since that kind of fallback can be triggered by an untrusted intermediary, it is no longer supported.
定位到答案原位置 👍 3所有回复 (2)
选择的解决方案
Firefox 48 can connect with servers that only advertise support for TLS 1.0 (assuming they use a valid certificate and ciphers that Firefox considers acceptable).
"Fallback" is a process where the server advertises support for TLS 1.2 but Firefox is unable to connect using TLS 1.2 for some reason, so Firefox used to try TLS 1.1, 1.0, even SSLv3. Since that kind of fallback can be triggered by an untrusted intermediary, it is no longer supported.
jscher2000 said
Firefox 48 can connect with servers that only advertise support for TLS 1.0 (assuming they use a valid certificate and ciphers that Firefox considers acceptable). "Fallback" is a process where the server advertises support for TLS 1.2 but Firefox is unable to connect using TLS 1.2 for some reason, so Firefox used to try TLS 1.1, 1.0, even SSLv3. Since that kind of fallback can be triggered by an untrusted intermediary, it is no longer supported.
Thank you for explaining fallback. I got some misunderstanding on that word :/
I will promote the answer a bit later since I am busy now.
Thanks again!