1

My ssl-enabled site has stopped working in Chrome 42. It still works in Chrome 41.

Qualys's test doesn't cover Chrome 42, but it also doesn't raise any issues that indicate it's about to stop working, either.

Has Chrome 42 dropped support for the previously negotiated cipher suite (TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b))?

1

2 Answers 2

2

Comparing client capabilities I have noted that Chrome 42 only supports the following elliptic curves:

Elliptic curves: secp256r1, secp384r1

(It appears that secp521r1 used to be supported in earlier versions, there is a bug report for this.)


While for instance Firefox 37 supports:

Elliptic curves secp256r1, secp384r1, secp521r1


Looking at the results for the SSLLabs test of your site, it appears that you are using a 521 bit curve.

Key: EC 521 bits

0

I hit this issue recently. From what I can tell the removal of support for secp521r1 was intentional: https://bugs.chromium.org/p/chromium/issues/detail?id=477623 and there are no plans to bring it back. The intent was to support 25519-curve server keys instead.

In our case we simply switched to a different server key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .