SSL problem ?

[Lucio Chiappetti]

I have just received an e-mail (not spam) from my municipal authorities, saying that they are refurbishing their portal, and that I need to refresh my registration.
However when I try to access (from PM 25.0.2 on SuSE LINUX) I get

Code: Select all

Secure Connection Failed
An error occurred during a connection to www.comune.milano.it. SSL received a record with an incorrect Message Authentication Code. (Error code: ssl_error_bad_mac_read)
    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.

Any hint about things to look in my configuration ?

[SvenG]

Did you already try what's in the FAQ about secure connections?
http://forum.palemoon.org/viewtopic.php?f=24&t=6262

[Lucio Chiappetti]

Pretty sure I did something about POODLE on my system a while ago. It would be very strange if the municipal authorities are improving their server using an obsolete or dangerous feature (but not impossible). Anyhow, if I change tls.min from 1 to 0, instead of the error code reported previously, I get a "server busy try later".

[Lucio Chiappetti]

Can somebody further help to diagnose the problem. User Agent Identification ? Sorry to say it, but I've been able to access the offending site with FF (and reset my password, that's all I had to do), but still PM cannot enter.

The site is http://www.comune.milano.it. Then click on "Servizi online" and try to register "Accesso e registrazione" (near top right). The failure occurs here.

[Moonchild]

Looks like they need to check and correct their server. I suggest they simply update their web server software to a current version.

https://www.ssllabs.com/ssltest/analyze.html?d=comune.milano.it

Grade given: F

This server is vulnerable to the POODLE attack against TLS servers. Patching required.
This server is vulnerable to MITM attacks because it supports insecure renegotiation.

Main problems for connectivity with Pale Moon:
The server supports only older protocols, but not the current best TLS 1.2.
There is no support for secure renegotiation.

[Lucio Chiappetti]

Thanks. In a sense I am deluded by the fact they announced an upgrade of their servers and in fact downgraded it to an old unsecure protocol.
I will try to report it hoping that, as a public administration, they are more responsive than the typical ISP in this country.