Good to know. I knew that I needed to do it, but I'll be sure to add support for this prior to Go 1.2.
(The TLS stack doesn't support renegotiation at all, so it's not vulnerable, but a client can't know that unless it echos the extension in question.)
Ah, you're using the Go TLS package? That makes sense ;-).
As it turns out the latest version of Firefox still connects to servers which don't indicate secure renegotiation; the parent poster caused the problem by mucking around with the TLS settings in about:config.
Re:Adam Langley's Pond: Secure Async Messaging
by nitrogen on Sunday July 14, 2013 @06:34AM
(#6040521)
Well, it looks like he wrote the Go TLS package.
Re:Adam Langley's Pond: Secure Async Messaging
by diaz on Saturday July 13, 2013 @11:43PM
(#6039850)
It seems to be that.
I had initializaed a new profile in firefox and played with some options in about:config and somehow the option security.ssl.require_safe_negotiation was set to true.
All this week this was the first website to fail because of that.
It works with it set to false.
https://www.ssllabs.com/ssltest/analyze.html?d=pond.imperial...
https://wiki.mozilla.org/Security:Renegotiation
https://community.qualys.com/blogs/securitylabs/2010/10/06/d...
If you set security.ssl.require_safe_negotiation to false in about:config you should be able to establish a connection.
[1] Edit: actually it's not; the parent poster had tweaked settings in about:config ;-)