Fix TLS 1.2 and 1.3 detection against Windows Server 2019 #280
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes the issue reported in #271.
It was found that Windows Server 2019 + IIS 10 rejects all TLSv1.2 connections if the
TLS_EMPTY_RENEGOTIATION_INFO_SCSV
cipher is not present in the ClientHello ciphersuites. The fix is to include this cipher in the protocol detection phase.Secondly, Windows Server 2019 + IIS 10 will respond to TLSv1.3 handshakes with a TLSv1.2 response when v1.3 is disabled (!). The solution is to parse the TLS extensions in the response and look for v1.3 explicitly listed in the
supported_versions
extension.