TLS1_2 handshakes not supported in chromium version 41.0.2272.76
Reported by
meraj.ji...@gmail.com,
Nov 19
|
||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Steps to reproduce the problem: 1: Enable minimal TLS_1.2 supported in chromium client code. 1. Trying to access TLS1_2 only supported site. 2. After a successful connect with server no handshaking done. 3. If I enable TLS1_1 and TLS1_2 both on server site then handshaking is done using TLS1_1 and after that rest communication is done using TLS1_2. What is the expected behavior? If server site has only TLS1_2 enabled then handshaking should also be done using TLS1_2 from client side. Client code is written using chromium version 41.0.2272.76. What went wrong? After analyzing the chromium (version 41.0.2272.76) code found that for some reason PK11_TokenExists(CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256) ( written in the file: src\net\socket\ssl_client_socket_nss.cc) always returning false. Did this work before? N/A Does this work in other browsers? N/A Chrome version: 41.0.2272.76 Channel: n/a OS Version: 10.0 Flash Version: Also noticed that exports_win.def does not contain any PK11_* methods. I tried with adding PK11_* methods in exports_win.def but still no luck.
,
Nov 19
Please update to a recent version. TLS 1.2 support is always present these days and has been for some time now. Not sure what's going on with 41, but ssl_client_socket_nss.cc does not even exist anymore. Even were there a bug in 41, we have not made changes to that branch for years now, so there's nothing actionable save for you updating.
,
Nov 19
Hi, Thanks for your response. Updating to a new version of chrome requires some business decision. However simply forcefully returning "true" from PK11_TokenExists(CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256) works for me. Now only concern is, Is it safe a forceful "true" return from PK11_TokenExists(CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256) ?
,
Nov 19
No, it's not safe at all to ship a product using code from M41, which has about three years worth of known security bugs. See https://chromereleases.googleblog.com/ for notes on various bugs fixed in that time frame. |
||
►
Sign in to add a comment |
||
Comment 1 by dtapu...@chromium.org
, Nov 19Labels: Needs-Feedback