3 ms·

I merely configured the website server TLS protocol to my exacting specs (in cryptographic and network security theatre) and Chrome failed because its client "d

I merely configured the website server TLS protocol to my exacting specs (in cryptographic and network security theatre) and Chrome failed because its client "demands" the non-ChaCha variants despite my TLS server INSISTING "my way or the highway". Beside, I am quite partial toward Firefox browser so there is little benefit for me to file a report to help Firefox's competitors.

londons_explore 4y ago
Looking again, your server is rejecting their HELO message. You seem to be using a modern cipher yet requiring a legacy (http/1.1) protocol, which I suspect is the issue. Adding an advertisement for TLS_CHACHA20_POLY1305_SHA256 to every TLS 1.3 handshake worldwide would add a lot of gigabytes of global bandwidth, for support of an awfully unusual configuration. Those 4 bytes in every http request globally probably isn't worth it just for you. Take a look at this trace [1]. I think it's pretty clear the client is offering a bunch of things, including TLS_CHACHA20_POLY1305_SHA256, and your server just replies 'nah, goodbye'. Perhaps your server doesn't like the ESNI extension? [1]: https://pastebin.com/ffP4cPJi https://pastebin.com/ffP4cPJi
- deleted 4y ago
  [deleted]
  - deleted 4y ago
    [deleted]
- superkuh 4y ago
  Yes, corporation persons desperately want people to move to http/2 and http/3 for for-profit reasons. They're terrible protocols for human persons though. Phasing out http/1.1 support in chrome/etc means phasing out the ability to host a website that can be visited by someone you don't know without the continued permission from a third party TLS CA.
  - kccqzy 4y ago
    This guy is already using TLS. The site has already obtained a certificate from a CA. How does http/1.1 or http/2 have anything to do with it?
    - superkuh 4y ago
      HTTP/2 and HTTP/3 implementations do not allow you to connect to an IP/domain unless there is CA based TLS. HTTP/1.1 allows both HTTP and HTTPS to coexist. If for some reason the CA based TLS cert is revoked I can always just visit the http site over HTTP/1.1.
- deleted 4y ago
  [deleted]
- egberts1 4y ago
  Your capture is asking for TLSv1.2. Not willing to support that. Only TLSv1.3+

londons_explore 4y ago

Looking again, your server is rejecting their HELO message. You seem to be using a modern cipher yet requiring a legacy (http/1.1) protocol, which I suspect is the issue. Adding an advertisement for TLS_CHACHA20_POLY1305_SHA256 to every TLS 1.3 handshake worldwide would add a lot of gigabytes of global bandwidth, for support of an awfully unusual configuration. Those 4 bytes in every http request globally probably isn't worth it just for you. Take a look at this trace [1]. I think it's pretty clear the client is offering a bunch of things, including TLS_CHACHA20_POLY1305_SHA256, and your server just replies 'nah, goodbye'. Perhaps your server doesn't like the ESNI extension? [1]: https://pastebin.com/ffP4cPJi https://pastebin.com/ffP4cPJi

deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]
superkuh 4y ago
Yes, corporation persons desperately want people to move to http/2 and http/3 for for-profit reasons. They're terrible protocols for human persons though. Phasing out http/1.1 support in chrome/etc means phasing out the ability to host a website that can be visited by someone you don't know without the continued permission from a third party TLS CA.
- kccqzy 4y ago
  This guy is already using TLS. The site has already obtained a certificate from a CA. How does http/1.1 or http/2 have anything to do with it?
  - superkuh 4y ago
    HTTP/2 and HTTP/3 implementations do not allow you to connect to an IP/domain unless there is CA based TLS. HTTP/1.1 allows both HTTP and HTTPS to coexist. If for some reason the CA based TLS cert is revoked I can always just visit the http site over HTTP/1.1.
deleted 4y ago
[deleted]
egberts1 4y ago
Your capture is asking for TLSv1.2. Not willing to support that. Only TLSv1.3+