On 07/11/2014 09:45 AM, Alex Rousskov wrote:
On 04/11/2014 11:01 PM, Amm wrote:
I recently upgraded OpenSSL from 1.0.0 to 1.0.1 (which supports TLS1.2)
Now there is this (BROKEN) bank site:
https://www.mahaconnect.in
This site closes connection if you try TLS1.2 or TLS1.1
<snip>
When I try in Chrome or Firefox without proxy settings, they auto detect
this and fallback to TLS1.0/SSLv3.
So my question is shouldn't squid fallback to TLS1.0 when TLS1.2/1.1
fails? Just like Chrome/Firefox does?
(PS: I can not tell bank to upgrade)
Amm.
On 07/10/2014 09:27 AM, Vadim Rogoziansky wrote:
Do you have any ideas how we can resolve it? I have the same issue.
I believe a proper support for "secure version fallback" requires some
development. I do not know of anybody working on this feature right now,
and there may be no formal feature requests on bugzilla, but it has been
informally requested before.
In addition to TLS v1.2->1.0 fallback, there are also servers that do
not support SSL Hellos that advertise TLS, so there is a need for
TLS->SSL fallback. Furthermore, some admins want Squid to talk TLS with
the client even if the server does not support TLS. Simply propagating
from-server "I want SSL" errors to the TLS-speaking client does not work
in such an environment, and a proper to-server fallback is needed.
Cheers,
Alex.
A similar discussion used to go on in Firefox bugzilla.
All are now FIXED.
Possibly we can simply look at what they did and follow?
https://bugzilla.mozilla.org/show_bug.cgi?id=901718
https://bugzilla.mozilla.org/show_bug.cgi?id=969479
https://bugzilla.mozilla.org/show_bug.cgi?id=839310
My current workaround is to put such sites in nosslbump acl i.e. NO SSL
bumping for sites which support only SSL. Then (Latest) Firefox
automatically detects SSL only site and does proper fallback.
Amm
