I noticed a strangeness in the TLS 1.2 Handshake and I don't know if I'm missing something.

Wireshark screenshot

As you can see in this screenshot, the browser (Chrome) puts the value 0x0301 as version in the Record Layer but it puts the 0x0303 value as version in the Handshake record. The used version is TLS 1.2 (SSL 3.3) actually. If I got it right, even the RFC5246 says that the value is 0x0303 for this version. So, Why the browser puts 0x0301 in the Record Layer?

  • 2
    See also this thread for related information. – user41341 Mar 15 '14 at 19:39

This is typical of a handshake that supports a minimum version that is lower than its preferred/maximum version.

In this case, the client is using a TLS v1.0 ClientHello Record, indicating minimum support for TLS v1.0, but inside the record is indicating support and preference for TLS v1.2

Using that technique, clients and servers can negotiate the best possible version that both share.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.