What browsers only use SSLv2? I'm planning to disable SSLv2 on our web server, and would want to know what browsers will be affected. I can't find anywhere what SSL versions Firefox 1/2 and IE6/7 support.
-
stackoverflow.com/questions/64621/…– ericksonCommented May 21, 2009 at 14:18
Add a comment
|
3 Answers
According to the book, Data Center Fundamentals, page 369, SSLv3 support was added in Netscape 2.x and Internet Explorer 3.x, and TLS was added in Netscape 4.x and Internet Explorer 4.x.
So, SSLv3 support has been widely available since 1995–1996.
My working assumption is that SSLv2-only browsers are not found outside a museum.
answered May 20, 2009 at 14:39
-
And also note that most version of Netscape 1.x that supports SSLv2 has a weak random number generator the protocol vulnerable to additional attacks. Commented Dec 23, 2012 at 2:54
-
This book is incorrect in that TLS did not become a standard until after 1997 and even then IE disabled it by default until IE7. Commented Jan 13, 2015 at 6:46
-
@YuhongBao Could you provide a citation for this information and explain how it's relevant to the question, which specifically deals with SSLv2?– ericksonCommented Jan 13, 2015 at 6:58
-
-
That's not relevant here. SSLv2 was supplanted by SSLv3, not TLSv1, and SSLv3 was published in 1996.– ericksonCommented Jan 17, 2015 at 20:13
To add to the answer, IE 6 without service packs only runs SSL 2. IE 6 with SPs can run SSL 3. WinXP can run up to IE 8.
http://windows.microsoft.com/en-ca/internet-explorer/ie-system-requirements#ie=ie-8
Unbelievably IE 6 is still out there, yes, even in 2014. But, frankly, if you're concerned about security, it doesn't make much sense to turn around and say, well, if you can't use a key I guess we'll just leave the door wide open. If security is important then enforce it. I know, I know, you don't want to inconvenience your clients. But seriously, update your expired XP machine already...
-
-
4...and yet I was looking for the answer...this year. Stumbled upon this post in my search; just added the information I found after the fact. Old questions don't mean they don't have new readers.– FreeTextCommented Apr 9, 2014 at 15:31
-
I believe that it depends on the underlying SSL library that is being used.
-
2
-
Because it depends on the library and not necessarily the browser?– sybreonCommented May 20, 2009 at 0:16
-
1Given a major number for a browser you can easily answer this question. For example, Firefox Y.Z will use version X of libfoo, where version X either supports SSLv3 or not. Commented Nov 3, 2011 at 18:35