I've written a similar rebuttal to your sibling's comment here[1]. This isn't "failing closed", and this isn't a whitelist. TLS allows you to whitelist to cert

I've written a similar rebuttal to your sibling's comment here[1]. This isn't "failing closed", and this isn't a whitelist. TLS allows you to whitelist to certain versions of the protocol during the initial negotiation at the start of the protocol; that is the opportunity for either end to state what version of the protocol they'd like. It is not permissible in the protocol to close the connection as Blue Coat is doing. This isn't a downgrade attack, either: both server and client are free to choose their protocol version at the beginning. The client & server will later verify that the actual protocol in use is the one they intended; this is what prevents downgrades. [1]: https://news.ycombinator.com/item?id=13751737 https://news.ycombinator.com/item?id=13751737