zlacker

>>codero+(OP)
Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to "analyze" TLS connections, and rejects anything it doesn't understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0.

In this case, it doesn't sound like they're reverting it because of overall breakage, but rather because it breaks the tool that would otherwise be used to control TLS 1.3 trials and other configuration. Firefox had a similar issue, where they temporarily used more conservative settings for their updater than for the browser itself, to ensure that people could always obtain updates that might improve the situation.

>>JoshTr+w
Sometimes it is even worse than that. Some of the middleware TLS proxies don't verify the certificate before they resign the data. They completely open up your enterprise to MITM attacks, and in fact hide the fact that you are being MITMed. This came to light way back during the Superfish debacle, and some vendors still have not fixed the problem.