3

Internet Explorer 6 supports TLS 1.0. However, for some reason that escapes me, https://tls-v1-0.badssl.com:1010/ (which is supposed to test whether a browser supports TLS v1.0) fails to open in Internet Explorer 6. And it fails to open not with "Cannot establish a secure connection.", but with "Cannot find server or DNS error.". Firefox 52 in that same virtual machine can open that web-page. What is going on?

5

I believe it's because that version of Internet Explorer does not support Server Name Indication, which is part of the TLS protocol which allows a secure handshake to be established when multiple domains with different certificates are hosted at the same IP. If badssl.com is hosted on shared hosting, then I think this explains your issue.

On Webmasters Stack Exchange, the following list of browsers supporting SNI is given: (accurate to November 2014)

Please also read this other question on Webmasters SE for more information about secure connections on shared and unique IPs.

Internet Explorer 7 or newer, on Windows Vista or newer.

Mozilla Firefox 2.0 or later

Opera 8.0 or newer (TLS 1.1 protocol needs to be enabled)

Opera Mobile with at least version 10.1 bèta on Android

Google Chrome (Vista or newer. XP on Chrome 6 or newer)

OS X 10.5.7 or newer on Chrome 5.0.342.1 or newer

Safari 2.1 or later (Mac OS X 10.5.6 or newer and Windows Vista or newer)

Konqueror/KDE 4.7 or newer

MobileSafari in Apple iOS 4.0 or newer

Android default browser on Honeycomb or newer

Windows Phone 7

MicroB on Maemo

The following browsers do not support SNI:

Internet Explorer, all versions, Windows XP

Safari, Windows XP

BlackBerry Browser

Windows Mobile 6.5 and lower

Android 2.x default browser

4
  • 1
    Interesting, that was my hunch when I saw the question... Jun 18 at 22:47
  • Then why exactly does Internet Explorer complain that there was a DNS error? Jun 19 at 8:43
  • 6
    @FlatAssembler The the error message doesn't say that. It says "Cannot find server or DNS error." The first part is correct so far as it goes, because connecting to the server needs some functionality that the software doesn't know about. You can't produce a good error message about something that doesn't even exist in your software.
    – alephzero
    Jun 19 at 13:20
  • 1
    @FlatAssembler: From what I (mis?)remember, IE used to show the rather generic "Cannot find server" even in situations where it could have shown a better one, e.g. if the server was simply down, or if it returned certain HTTP error codes. It just wasn't very good at error messages in general.
    – user1686
    Jun 20 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.