SSL/TLS secure/insecure browsing with Firefox

I had to revisit and update this post to make it more useful. Initially, it was about Mozilla Firefox browser throwing the error ssl_error_no_cypher_overlap back at its users when trying to access certain URLs.

Nowadays, current Firefox ESR simply reports a Secure Connection Failed leaving the user to deal with its frustration.

The well-known quick & dirty workaround is described below:
1) Open configuration page “about:config” and search for item “security.tls.version.min“.
2) Double click to edit the configuration item mentioned earlier and set its value to “0” (zero).

ffox_tls_config
Visual Help

WARNING! Even if the above will ‘solve’ your trouble it’s worth understanding the real issue here.

The change was required for security reasons, specifically, as a reaction to recent ‘POODLE‘ vulnerability.
Oh, and the not so good news is the fact that this is also related to SSL.
Yes, when we were just slowly recover after ‘HEARTBLEED‘ frenzy.

Google Chrome users, look here.

OK, so what is new here? Well, I recently learned that the above trick may no longer suffice. But why?
Because there is a limit for everything, including how many times Mozilla will allow you to weaken its security.
Luckily, we can modify this as well. Just search for security.tls.version.fallback-limit and set it to “0” zero.

If you have an older version of Firefox, this article is also worth reading.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s