Este site irá ter funcionalidade limitada enquanto fazemos manutenção para melhorar a sua experiência. Se um artigo não resolve o seu problema e quiser colocar uma questão, temos a nossa comunidade de apoio à espera de o ajudar em @FirefoxSupport no Twitter, /r/firefox no Reddit.

Pesquisar no apoio

Evite burlas no apoio. Nunca iremos solicitar que telefone ou envie uma mensagem de texto para um número de telefone ou que partilhe informações pessoais. Por favor, reporte atividades suspeitas utilizando a opção "Reportar abuso".

Saber mais

GPO (Group Policy) Change security.tls.enable_0rtt_data

  • 8 respostas
  • 1 tem este problema
  • 1 visualização
  • Última resposta por Mike Kaply

more options

Hello,

we have some trouble in our Enterprise Environment with tls 1.3 and 0rtt data. The integrated google search and other websites doesnt work as they should (Pages doesnt load and stay white).

So we want to turn of "security.tls.enable_0rtt_data" with Group Policy. But i cannot find a switch for this setting.

When i try to set security.tls.enable_0rtt_data with Preferences in GPO it doesnt work (old Preferences is empty) { "security.tls.enable_0rtt_data": { "Value": false, "Status": "locked" } }

With Preferences i am able to configure security.tls.hello_downgrade_check, but not security.tls.enable_0rtt_data

The only workaround would be to disable tls 1.3 completely and use tls 1.2. (security.tls.version.max = 3) Is there a solution for this?

Regards, Michael

Hello, we have some trouble in our Enterprise Environment with tls 1.3 and 0rtt data. The integrated google search and other websites doesnt work as they should (Pages doesnt load and stay white). So we want to turn of "security.tls.enable_0rtt_data" with Group Policy. But i cannot find a switch for this setting. When i try to set security.tls.enable_0rtt_data with Preferences in GPO it doesnt work (old Preferences is empty) { "security.tls.enable_0rtt_data": { "Value": false, "Status": "locked" } } With Preferences i am able to configure security.tls.hello_downgrade_check, but not security.tls.enable_0rtt_data The only workaround would be to disable tls 1.3 completely and use tls 1.2. (security.tls.version.max = 3) Is there a solution for this? Regards, Michael

Solução escolhida

FYI, the ability to set this pref via policy landed in the most recent Firefox and ESR.

Ler esta resposta no contexto 👍 0

Todas as respostas (8)

more options

There is an entry about that Error. Open since 3 months!!!

https://bugzilla.mozilla.org/show_bug.cgi?id=1718520

more options

We don't allow all security prefs to work in policy for security reasons.

This is the first time I've heard about this one.

I'm reaching out to the security team.

more options

I'm going to add that pref to policy. It will be in the Firefox and ESR release in a couple weeks.

more options

Thank you very much Mike!

The Firefox Dev´s should implement another fallback routine for TLS 1.3 or disable 0-RTT Data in default settings. I think 0-RTT Data wont work in business environments with proxy servers. i dont know why, but google chrome can establish TLS 1.3 connections without any further configuration. (i dont know how chrome handle 0-RTT Data. They may have disabled it?)

Regards, Michael

more options

That bug has been marked a priority 1 now so someone should be looking at how to solve.

more options

Solução escolhida

FYI, the ability to set this pref via policy landed in the most recent Firefox and ESR.

more options

Thanks for your reply and your engagement. You can set this pref now via policy.

But the default behavior has not changed. You MUST set this preference in enterprise environments with a proxy server or Firefox ESR will not work properly as described in my first post.

more options

Unfortunately I don't control that. I've brought it up with the team that made this switch.

I would recommend opening a bug in bugzilla asking that the default be changed until Google changes it.