[SOLVED] Firefox 3 + Zimbra 5 - TLS Interop issue

[stephanhughson]

Originally Posted by p24t

I have no more issues as of updating to 5.0.6. Whichever it is, it's been solved.

We are running 5.0.5, so that might be it... We'll schedule an upgrade, needs to be done really anyway.

Thanks. If it still happens, I'll post here again.

[mmorse]

To wrap up this thread:

FF3 attempts to use TLS first when making an https connection, but the SslEngine in Java6 does not appear to handle this and simply times out before FF3 falls back to normal SSL.

A switch to JDK 1.5 while running Zimbra 5.0.4/.5, or upgrade to 5.0.6+ (which uses JDK1.5 intentionally) resolves the issue (5.0.8 is current).

We ran JDK1.6 till 5.0.5, and we downgraded for 5.0.6 to avoid 3 Sun bugs:
Bug ID: 6614100 EXCEPTION_ACCESS_VIOLATION while running Eclipse with 1.6.0_05-ea - fixed
Bug ID: 6546278 Synchronization problem in the pseudo memory barrier code - fixed
Bug ID: 6693490 (se) select throws "File exists" IOException under load (lnx) - still open but fix planned

Recent convo on those: http://www.zimbra.com/forums/administrators/20189-testing-jdk-1-6-x-zimbra-5-0-x.html (notes this TLS issue is still prevalent in JDK 1.6u7)
While we do have a few customers who have also gone back to JDK1.6 for one reason or another because they have modifications that depend on it, I would run NE with what we build/support - if you must upgrade them please notify support whenever you/they open tickets that it's using JDK1.6

Bug 13487 – Upgrade to JDK 1.6 for 5.0.x series, then Bug 27890 – Downgrade to JDK 1.5.0_15 for 5.0.6

Tools > options > advanced > encryption > uncheck TLS 1.0 if you're really curious to test the difference using FF3 against JDK1.6
Though it's not exactly something you want to have to do on a mass of users & it's enabled by default for a reason.

More: [#JETTY-567] Delay in initial TLS Handshake With FireFox 3 beta5 and SslSelectChannelConnector - jira.codehaus.org

This is filed for tracking/retesting whenever we officially upgrade to JDK1.6: Bug 29631 – delay loading login page when using Firefox 3 over SSL/TLS

Tools > options > advanced > encryption > uncheck TLS 1.0 if you're really curious to test the difference using FF3 against JDK1.6
Though it's not exactly something you want to have to do on a mass of users & it's enabled by default for a reason.