12

I reconfigured my browser (Firefox 26) to fully demand TLS version 1.2 (and only this version) when connecting to any website. After some day of experience in browsing the net I noticed that when going to StackOverflow (or any other StackExchange website) my browser just says ssl_error_no_cypher_overlap.

After a little downscaling of my security settings in Firefox (for those who are interested: security.tls.version.min and security.tls.version.max both set to 3 which means TLS Version 1.2) I noticed that the whole StackExchange Network relies on TLS Version 1.0.

I just wanted to ask if there are plans to enhance the security of the TLS encrypted connections to a newer standard since TLS 1.0 is pretty outdated, espacially for a highly technical network like this. Are there any plans to do this in the near future or are there any roadmaps regarding this type of security concerns?

  • 1
    The security concerns are relatively minor, there are far bigger SSL related issues which should be prioritized over this. But it makes me wonder what SSL library they use since OpenSSL (the most popular server side lib) has TLS 1.2 enabled by default. – CodesInChaos Jan 17 '14 at 12:25
  • 1
    @CodesInChaos I believe they mainly use Microsoft software, and their system is hosted on a IIS server, not on Apache... And MS is certainly not using OpenSSL as its crypto library. – dim Mar 2 at 12:51
  • For the sake of linking to the reason of status-completed tag: TLS 1.0 and TLS 1.1 removal for Stack Exchange services – Tensibai Mar 2 at 15:49

You must log in to answer this question.

Browse other questions tagged .