Hotmail TLS1.2 bug

14. July 2012 · Write a comment · Categories: Hotmail · Tags: , , , , , , ,

Didn't know if this is the correct place to post a bug report but here goes...
Hotmail and Calendar will not render properly when TLS1.2 is turned on in the browser. From a Windows 7 client


Detailed Symptoms:
https://gfx6.hotmail.com
https://gfx7.hotmail.com
https://gfx8.hotmail.com etc.
Fail to connect e.g to fetch "https://gfx8.hotmail.com/mail/16.2.7040.0620/styles/Base/Full/hig.css"
So all the Inbox page formatting is lost (no images, all links listed down the left). Calendar fails to load at all.


Extra info:
Packet captures show a TLS1.2 TLSCipherSuite: TLS_RSA_WITH_AES_256_CBC_SHA256 { 0x00, 0x3D } Server hello followed by an immediate client connection closure.
Schannel errors appear in the event log "The following fatal alert was generated: 40. The internal error state is 252" i.e. Handshake error. My best guess is that these handshake failures are due to the Server Hello returns the full Certificate chain back to AND INCLUDING the "GTE CyperTrust Gobal Root" Root Cert. This is a MD5 Signed cert but the default ClientHello Signature extension does not list MD5/RSA as an allowed signing algorithm. So the client is aborting.