Join the AMA (Ask Me Anything) with the Firefox leadership team to celebrate Firefox 20th anniversary and discuss Firefox’s future on Mozilla Connect. Mark your calendar on Thursday, November 14, 18:00 - 20:00 UTC!

Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

Behavior for security.tls.version.fallback, max and min

  • 2 replies
  • 6 have this problem
  • 1 view
  • Last reply by DSakura

DSakura
DSakura
more options

Hi folks, I have a question about this combination in config: security.tls.version.fallback-limit = 3

security.tls.version.max = 3

security.tls.version.min = 1

All of those are default in FF 48.0.2 .

According to KB, FF should allow TLS 1.0, 1.1 and 1.2, and fallback is not allowed from TLS 1.2.

Here is my question: if the server only supports TLS 1.0, what will FF do? Refuse it or happily connect to the server?

Hi folks, I have a question about this combination in config: security.tls.version.fallback-limit = 3 security.tls.version.max = 3 security.tls.version.min = 1 All of those are default in FF 48.0.2 . According to KB, FF should allow TLS 1.0, 1.1 and 1.2, and fallback is not allowed from TLS 1.2. Here is my question: if the server only supports TLS 1.0, what will FF do? Refuse it or happily connect to the server?

Modified by DSakura

Chosen solution

Firefox 48 can connect with servers that only advertise support for TLS 1.0 (assuming they use a valid certificate and ciphers that Firefox considers acceptable).

"Fallback" is a process where the server advertises support for TLS 1.2 but Firefox is unable to connect using TLS 1.2 for some reason, so Firefox used to try TLS 1.1, 1.0, even SSLv3. Since that kind of fallback can be triggered by an untrusted intermediary, it is no longer supported.

Read this answer in context 👍 3

All Replies (2)

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Chosen Solution

Firefox 48 can connect with servers that only advertise support for TLS 1.0 (assuming they use a valid certificate and ciphers that Firefox considers acceptable).

"Fallback" is a process where the server advertises support for TLS 1.2 but Firefox is unable to connect using TLS 1.2 for some reason, so Firefox used to try TLS 1.1, 1.0, even SSLv3. Since that kind of fallback can be triggered by an untrusted intermediary, it is no longer supported.

DSakura
DSakura Question owner
more options

jscher2000 said

Firefox 48 can connect with servers that only advertise support for TLS 1.0 (assuming they use a valid certificate and ciphers that Firefox considers acceptable). "Fallback" is a process where the server advertises support for TLS 1.2 but Firefox is unable to connect using TLS 1.2 for some reason, so Firefox used to try TLS 1.1, 1.0, even SSLv3. Since that kind of fallback can be triggered by an untrusted intermediary, it is no longer supported.

Thank you for explaining fallback. I got some misunderstanding on that word :/

I will promote the answer a bit later since I am busy now.

Thanks again!