Issue metadata
Sign in to add a comment
|
SSL or cipher suite mismatch after updating Chromium
Reported by
moog...@gmail.com,
Dec 31 2016
|
||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:38.9) Gecko/20100101 Goanna/2.0 Firefox/38.9 PaleMoon/26.2.1 Example URL: https://1337matrixp.pl Steps to reproduce the problem: 1. Update Chromium to 56.0.2924.21 2. Configure the webserver on 1337matrixp.pl (I am the owner, the webserver config is provided below) 3. Go to https://1337matrixp.pl What is the expected behavior? A simple website should appear What went wrong? Instead I'm getting ERR_SSL_VERSION_OR_CIPHER_MISMATCH in Chromium Did this work before? Yes Can't remember Chrome version: 56.0.2924.21 Channel: stable OS Version: Gentoo Flash Version: The website's certificate is signed by Let's Encrypt CA, and it uses a secp384r1 curve key. The webserver is configured to use that certificate chain with the following parameters: ssl_protocols TLSv1.2; ssl_ciphers !EECDH+AESGCM:!DH+AESGCM:ECDH+AES256:DH+AES256:!ECDH-AES128:!DH-AES128:!ECDH-3DES:!DH-3DES:!aNULL:!MD5:!DSS:!AES128;
,
Jan 3 2017
Yup. Why do you have "!EECDH+AESGCM" in your cipher config? You're going out of your way to disable the only ciphers in TLS which are not known to be broken.
,
Jan 4 2017
@davidben Qualys SSL test suggested I do not use GCM ciphers, but it kept coming up in tests, so I tried to disable anything that they claimed was there and used GCM.
,
Jan 4 2017
That's backwards. Did you perhaps misinterpret things? That's backwards. Remove "!EECH+AESGCM" from your cipher suite config. The AEAD-based ciphers (so GCM ciphers and CHACHA20_POLY1305 if you have a sufficiently new stack) are the only non-broken ones we've got. The others are being removed in TLS 1.3 and Qualys has announced here that, in 2017, AEAD-based ciphers will be necessary for an "A+" rating. (I'm disappointed they aren't required today since we've known for a while that TLS's CBC-mode ciphers are broken, but better late than never.) https://blog.qualys.com/ssllabs/2016/11/16/announcing-ssl-labs-grading-changes-for-2017 https://tlswg.github.io/tls13-spec/#rfc.appendix.B.4
,
Jan 4 2017
Going to go ahead and WontFix this (Not trying to discourage further discussion here, just don't want this bug to remain open once the discussion stops). |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by mmenke@chromium.org
, Jan 3 2017Components: -Internals>Network Internals>Network>SSL