Removing Old Versions of TLS
blog.mozilla.org
Removing Old Versions of TLS
1–10 of 94 posts
Re: Removing Old Versions of TLS
#2That’s awesome. Server side software should also be actively removing those old protocols.
Re: Removing Old Versions of TLS
#3So if we remove TLS 1.1 from our servers and just offer 1.2, we fail on fallback when testing through Qualys.
Re: Removing Old Versions of TLS
#4Most of the pushback here isn't going to be on the web. It's going to be in corporate systems and proxies that haven't upgraded, and reject anything they don't understand.
For instance, some corporate proxies will parse TLS and drop connections they don't understand. Theoretically, they do this to combat things like Heartbleed; in practice, they do it because the same tools will (with the flip of a switch) do termination and interception.
Re: Removing Old Versions of TLS
#5So if we remove TLS 1.1 from our servers and just offer 1.2, we fail on fallback when testing through Qualys.
Mozilla and Chrome and others will need to work with the various sites testing TLS (and "SSL") to make sure their tests stop asking for this.
Re: Removing Old Versions of TLS
#6So if we remove TLS 1.1 from our servers and just offer 1.2, we fail on fallback when testing through Qualys.
As far as security goes, that sounds like a good thing.
Re: Removing Old Versions of TLS
#7Most of the pushback here isn't going to be on the web. It's going to be in corporate systems and proxies that haven't upgraded, and reject anything they don't understand. For instance, some corporate proxies will parse TLS and drop connections they don't understand. Theoretically, they do this to combat things like Heartbleed; in practice, they do it because the same tools will (with the flip of a switch) do termina…
There are still some essential government, military and corporate websites relying on these protocols that will not be updated any time soon - it should always be possible for a user to override this block.
I really dislike this "browser smarter than the user" design.
Re: Removing Old Versions of TLS
#8If you want Nginx to use TLS v1.2, this is what you need:
ssl_protocols TLSv1.2;
ssl_protocols TLSv1.3 TLSv1.2;
Re: Removing Old Versions of TLS
#9Most of the pushback here isn't going to be on the web. It's going to be in corporate systems and proxies that haven't upgraded, and reject anything they don't understand. For instance, some corporate proxies will parse TLS and drop connections they don't understand. Theoretically, they do this to combat things like Heartbleed; in practice, they do it because the same tools will (with the flip of a switch) do termina…
There are still some essential government, military and corporate websites relying on these protocols that will not be updated any time soon - it should always be possible for a user to override this block. I really dislike this "browser smarter than the user" design.
This isn't the browser acting smarter than the user; this is the browser trying to push the web forward that last little bit so that everyone is more secure.
I'm sure that alternatives will exist for people who know they need to deal with TLS 1.0 for a while longer.
Re: Removing Old Versions of TLS
#10So if we remove TLS 1.1 from our servers and just offer 1.2, we fail on fallback when testing through Qualys.
There's no reason to remove TLS 1.1 from your server. This change is about the minimum protocol version supported by the browser.
Your server can advertise SSLv3 support alongside TLS 1.2, and Chrome 70 will still happily connect to it.