Repository navigation
CertificateSelection callback is not called when client use Unified framing #68310
Description
Some older TLS implementations can use Unified framing e.g. legacy SSL2 format with TLS 1.x body.
With 6.0, we fail to detect the client hello and therefore we fail to call the callback.
This is going to fail completely with 7.0 code base.
Activity
karelz commentedon Apr 21, 2022
Triage: Used by YARP customer with older devices.
wfurt commentedon Apr 21, 2022
Just to elaborate little bit more:
The example above is TLS 1.0 session. The first frame comes in as sslv2/Unified formatted hello and server respond with "normal" TLS 1.0 ServerHello. This generally prevents any TLS extensions but it would achieve TLS 1.0 security e.g. no real ssl2 involvement.