Explanation for CONNECT observations using Fiddler for url https://www.fiddler2.com/fiddler2/version.asp

1
votes

I'm using IE9 beta and Fiddler to understand the https session negotiation taking place for the above url (chosen for no paritcular reason other than it's secured).

Some observations made me curious.. does anyone understand what's happening here?

1. When I connect with Fiddler setting: HTTPS decrypt OFF, I see this sequence

  • 5 CONNECTs to fiddler2.com with nothing but headers showing

a) Curious, why more than one?

  • 1 CONNECT to beta.urs.microsoft.com

b) Does this have something to do with asking MS which cert it recognises? I thought this data is supposed to be kept locally? Maybe that only happened because I'm using a beta of IE9?

  • 4 CONNECTs to fiddler2.com with the same SessionID but different Random and the list of ciphers available on the client.

  • 1 CONNECT to beta.urs.microsoft.com with similar content to above 4

c) Why the multiple CONNECTs here with different Random?

2. When I connect with Fiddler setting: HTTPS decrypt ON, I see this sequence

  • 5 CONNECTs to fiddler2.com with nothing but headers in the request only and the response shows a certificate and the chosen cipher. Same in all 5.

a) same question

  • 1 GET with the page contents

d) what happened to the extra CONNECTs this time?

I'm trying to relate what I see here to the negotiation between client and server as it's documented here.

Transport Layer Security

Tyia, Mick.

1
httphttpssecurityfiddlerinternet-explorer-9

1 Answers

3
votes

You didn't mention what browser you're using and what ciphers you have enabled in that browser.

Sometimes, you'll see multiple CONNECT handshakes because the server immediately closes the connection (ungracefully stating that they don't support the requested protocol version) and the client will retry (fallback) to an older protocol version. You definitely see this happen a lot if you enable TLSv1.1 and TLSv1.2 in IE, for instance.

You also may see multiple CONNECTs if the client aborts a connection and then attempts to open a new one.

urs.microsoft.com and beta.urs.microsoft.com are used for the SmartScreen site-reputation feature.