Subject: [TLS] NSS server and Firefox client available for renegotiation interop testing

From: Daniel Veditz <[email-masked]>
Date: Fri, 12 Feb 2010 12:48:23 -0800

Kai Engert of Red Hat has set up a server running NSS 3.12.6rc1 for
interoperability testing of the NSS implementation of the
renegotiation spec. Three different ports represent different
configuration settings sites might want to use depending on their
need to support unpatched clients and renegotiation.

https://ssltls.de/

There are also Firefox test builds that support the new spec. The
current default setting requires safe re-negotiation, but allows an
initial negotiation to an unpatched server. Preference settings can
make the client reject unsafe initial handshakes or merely strip the
SSL markings from the chrome and at some future point we'll be
turning those on, but initially the client will be fairly lenient.

We can't predict when this code will make it into a future Firefox
security update until after we get some interoperability testing,
but we're hoping sooner than later.

A page describing the client options is at
https://wiki.mozilla.org/Security:Renegotiation

Nightly test builds are at
https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/

Huge thanks to Nelson Bolyard for writing the NSS code, Robert
Relyea of Red Hat for picking up the baton from Nelson, and Kai
Engert who wrote the client integration code.

-Dan Veditz