Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix TLS 1.2 and 1.3 detection against Windows Server 2019 #280

Merged
merged 2 commits into from
Apr 8, 2023

Conversation

jtesta
Copy link
Contributor

@jtesta jtesta commented Apr 4, 2023

This fixes the issue reported in #271.

It was found that Windows Server 2019 + IIS 10 rejects all TLSv1.2 connections if the TLS_EMPTY_RENEGOTIATION_INFO_SCSV cipher is not present in the ClientHello ciphersuites. The fix is to include this cipher in the protocol detection phase.

Secondly, Windows Server 2019 + IIS 10 will respond to TLSv1.3 handshakes with a TLSv1.2 response when v1.3 is disabled (!). The solution is to parse the TLS extensions in the response and look for v1.3 explicitly listed in the supported_versions extension.

@rbsec rbsec merged commit 4eb8374 into rbsec:master Apr 8, 2023
@rbsec
Copy link
Owner

rbsec commented Apr 8, 2023

Once again, Microsoft showing that standards for something for other people to follow....

Fantastic work as always - trying to work out what MS are doing is always a nightmare, so thanks so much for taking this on.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants