Avatar for Username

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

Browser still uses TLS_AES_128_GCM_SHA256 (0x1301) 128-bit SSL encryption cipher even when disabled in about:config

  • 1 reply
  • 1 has this problem
  • 97 views
  • Last reply by cor-el

user1555634
user1555634

Even after disabling all the 128-bit cipher suites in about:config, the cipher TLS_AES_128_GCM_SHA256 (0x1301) is still being used.

I used Qualys SSL Labs Client Test (https://www.ssllabs.com/ssltest/viewMyClient.html), and saw that TLS_AES_128_GCM_SHA256 (0x1301) remains to be the most preferred cipher suite.

All TLS 1.3 connections, such as facebook.com and cloudflare.com, uses that particular AES-128 cipher suite.

Is this a feature or a bug?

Even after disabling all the 128-bit cipher suites in about:config, the cipher TLS_AES_128_GCM_SHA256 (0x1301) is still being used. I used Qualys SSL Labs Client Test (https://www.ssllabs.com/ssltest/viewMyClient.html), and saw that TLS_AES_128_GCM_SHA256 (0x1301) remains to be the most preferred cipher suite. All TLS 1.3 connections, such as facebook.com and cloudflare.com, uses that particular AES-128 cipher suite. Is this a feature or a bug?

Chosen solution

See:

  • Bug 1490902 - TLS 1.3 Adds & Prioritizes 3 Cipher Suites with inferior security to TLS 1.2 Suites

(please do not comment in bug reports
https://bugzilla.mozilla.org/page.cgi?id=etiquette.html)

Read this answer in context 👍 1

All Replies (1)

cor-el
cor-el
  • Top 25 Contributor
  • Moderator

Chosen Solution

See:

  • Bug 1490902 - TLS 1.3 Adds & Prioritizes 3 Cipher Suites with inferior security to TLS 1.2 Suites

(please do not comment in bug reports
https://bugzilla.mozilla.org/page.cgi?id=etiquette.html)