Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.Sign up
tinkercad.com was seeing 10%-15% of our users fail to connect to our https servers due to the browser using SSL 3.0 instead of TLS 1.0. agl speculates that this might occur both due to misconfigurations and due to browser automatically downgrading from TLS 1.0 to SSL 3.0. For sites running https a recommendation would be to monitor any http/https transitions to try to verify how much of their population is running into this issue. As per offline discussion, please file this bug against agl to track adding SSL 3.0 support to crypto/tls.
FiloSottile pushed a commit to FiloSottile/go that referenced this issue
Oct 12, 2018
It would be nice not to have to support this since all the clients that we care about support TLSv1 by now. However, due to buggy implementations of SSLv3 on the Internet which can't do version negotiation correctly, browsers will sometimes switch to SSLv3. Since there's no good way for a browser tell a network problem from a buggy server, this downgrade can occur even if the server in question is actually working correctly. So we need to support SSLv3 for robustness :( Fixes golang#1703. R=bradfitz CC=golang-dev https://golang.org/cl/5018045
This issue was closed.