Can I re-enable SSL in Firefox without downgrading? When I hit an SSL-only site, my only current option is to use another browser.
Just hit an SSL-only site that I needed to access that FF 35 blocked. I don't see an obvious way to create an exception or re-enable it. We need this option... many users understand POODLE and can make an intelligent decision regarding the risks. TLS has its vulnerabilities as well.
Chosen solution
hello ancistrus, as you know ssl3.0 encrypted connections can be no longer considered secure since an attack vector against them ("POODLE") has become known. please contact the webmaster in charge of the site and urge them to update their encryption to something contemporary. https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
if you want to re-enable ssl 3.0 in firefox you can do that - however keep the consequences in mind, that you will become vulnerable to the attack mentioned above: enter about:config into the firefox address bar (confirm the info message in case it shows up) & search for the preference named security.tls.version.min. double-click it, change its value to 0 and restart the browser.
Read this answer in context 👍 11All Replies (5)
Chosen Solution
hello ancistrus, as you know ssl3.0 encrypted connections can be no longer considered secure since an attack vector against them ("POODLE") has become known. please contact the webmaster in charge of the site and urge them to update their encryption to something contemporary. https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
if you want to re-enable ssl 3.0 in firefox you can do that - however keep the consequences in mind, that you will become vulnerable to the attack mentioned above: enter about:config into the firefox address bar (confirm the info message in case it shows up) & search for the preference named security.tls.version.min. double-click it, change its value to 0 and restart the browser.
Thanks, exactly what I needed.
You can use this extension to enable SSL3 temporarily for a website that needs SSL3.
- SSL Version Control: https://addons.mozilla.org/firefox/addon/ssl-version-control/
What philipp should have mentioned about changing the security.tls.version.min to zero is that this should only be done temporary and not made as a permanent change. You may go to another site and think you were secure when you are not due to it using the vulnerable SSL 3.0.
"contact the webmaster in charge of the site and urge them to update their encryption to something contemporary."
Is the least helpful comment one could imagine.
It's a government website. YOU try getting in touch with one of their webmasters and getting them to do anything.