User.js: SSL_ERROR_UNSAFE_NEGOTIATION [solved: security.ssl.require_safe_negotiation]

[zdat]

Was wondering which pref could be causing this error. Site seems to work on a stock firefox.

"An error occurred during a connection to X. Peer attempted old style (potentially vulnerable) handshake.
Error code: SSL_ERROR_UNSAFE_NEGOTIATION
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem."

Thanks.

[geeknik]

Probably this one right here:

user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);

If not that one, then try this one:

user_pref("security.ssl.require_safe_negotiation", true);

They are both set to false on stock Firefox.

[zdat]

Thanks. The second one did it (1201). First one (1270) displays the warning on the padlock for sites that would normally be blocked by 1201.

[Thorin-Oakenpants]

• 1270 is about displaying a visual clue in the urlbar: it is not 100% reliable (e.g. subresources), but there is no harm in leaving it active in the user.js as true
• 1201 is the one that can break some sites: and it should be rare (everyone will get different mileage)

[bryce-lynch]

1201 is the one that can break some sites: and it should be rare

I just got the SSL error after clicking an eBay link (something like https://svcs.ebay.com/delstats/clk/rtm?url=https%3A%2F%2Fwww.ebay.com.....) and had to disable 1201. Weird.

[geeknik]

1201 breaks tools.cisco.com as well, they are aware of it, probably won't fix it as they can't understand why anyone would flip this pref on. 🤣