IE11 on windows 8.1 and ssl fallback

Question

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 implementation on it doesn't seem to work with most browsers. So with it configured as SSLv3, it works with Chrome, Safari, and Firefox, but not IE11.

It seems that IE11 on Windows 8.1 will not fall back to using SSLv3. Strangely, if I go into advanced setting on IE11 and disable all TLS options and leave only SSLv3 checked, then it WILL work. It just doesn't seem to fallback properly unless I uncheck the TLS settings in advanced options.

Anyone have any idea why IE11 isn't falling back to using SSLv3?

Thanks in advance for any light you can shed upon this.

Answer 1

Can you explain exactly how the other browsers fall back? I've seen the following scenarios with servers and middleboxes:

• try to connect with TLS 1.0 or higher, peer responds with SSLv3 and thus the connection continues with SSLv3. This usually succeeds.
• try to connect with TLS 1.0 or higher, peer closes connection and browser tries again with lower TLS version. This usually succeeds.
• try to connect with TLS 1.0 or higher, peer drops client hello and does not close connection. This times out after a while. In this case the browser does not retry with a lower version because it does not assume an SSL-related problem.

IE11 on Win8 does the initial client hello without offering RC4 cipher. If sonicwall just drops this client hello instead of closing the connection or sending an TLS alert you might run into the case where the browser does not retry.

You might make a packet capture (wireshark) to see what is going on.