3 ms·

The whitelist was introduced here: https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbffaa https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbf.

The whitelist was introduced here: https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbffaa https://hg.mozilla.org/releases/mozilla-aurora/rev/1e9694bbf... https://bugzilla.mozilla.org/show_bug.cgi?id=1128227 https://bugzilla.mozilla.org/show_bug.cgi?id=1128227 It's described as "TLS Intolerance fallback whitelist". It seems to allow RC4 and SSL3

yuhong 11y ago
Background: Servers are supposed to respond to ClientHellos indicating newer versions of SSL/TLS with a ServerHello indicating the latest version the server supports. However not all servers did that properly. Thus browsers used to fall back to ClientHellos indicating old TLS and SSLv3 versions to support them. In this case, this server incorrectly responded to ClientHellos indicating SSL/TLS versions other than 1.0 with a SSLv3 ServerHello!