Is it possible to disable TLS1.0 in Chrome?

Question

I use LastPass. In Chrome, I cannot access the website www.lastpass.com. In IE and Firefox, I can access it only if I disable TLS1.0 in those browsers.

When heartbleed came out, all of a sudden I was unable to access www.lastpass.com from Chrome. I tried uninstalling, reinstalling everything, nothing has worked.

So now, I would like to simply find a way to disable TLS1.0 in Chrome. How can I go about doing this? (I have the latest version of Chrome, which is 34.0.1847.137 m).

Answer 1

The way you tell your story, it seems to me that a likely culprit is the firewall of your workplace. I will show you in the following how to test this hypothesis. If instead everything works fine, I can only suggest you re-install Chrome, because nothing, in a successful installation, should prevent you from connecting to LastPass.

In order to test whether it is your LAN firewall that blocks access to LastPass, you may proceed as follows: download nmap, a scan utility that is available for all OSes, then issue this command:

   (sudo) nmap -p 443 -sT www.lastpass.com 

(the sudo is necessary in *Nix systems). If you can contact it, then you have problem with your browser. If instead it hangs, and in general does not reply, open your browser and go to http://www.yougetsignal.com/tools/open-ports/, where you may input the IP address of LastPass (deduced, for instance, from the previous nmap's output), and choose 443 as a port. If you get the reply that LastPass can be contacted at the same IP address you used for nmap, and nearly simultaneously, then it means someone along your path to LastPass is not letting your packets through. Most likely, your local firewall.

Like I said above, if instead nmap manages to contact LastPass, (which will produce an output similar to the following:

  nmap -p 443 -sT www.lastpass.com

 Starting Nmap 6.40 ( http://nmap.org ) at 2014-05-20 19:21 CEST
 Nmap scan report for www.lastpass.com (128.121.22.187)
 Host is up (0.24s latency).
 Other addresses for www.lastpass.com (not scanned): 38.127.167.59
 rDNS record for 128.121.22.187: download.lastpass.com
 PORT    STATE SERVICE
 443/tcp open  https

 Nmap done: 1 IP address (1 host up) scanned in 2.67 seconds

), you have problem with your Chrome installation, which will need to be redone.

EDIT:

Given that there is no foul play from your site's firewall, let us try to force Windows7 to update TLS to 1.1/1.2, which is not enabled by default on Windows7, just Windows8. There are two ways:

1. You may import these registry keys,

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client] "DisabledByDefault"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server] "DisabledByDefault"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client] "DisabledByDefault"=dword:00000000

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server] "DisabledByDefault"=dword:00000000

2. or you may download this zip file and then double-click on Enable TLS 1.x on Windows 7.reg.

Edit2:

I jut found out, by Googling, something I did not know: in Chrome, it is possible to enable support for TLS 1.1/1.2 on the command line, by means of:

 --ssl-version-max  Specifies the maximum SSL/TLS version ("ssl3", "tls1", "tls1.1", or "tls1.2"). 
  --ssl-version-min     Specifies the minimum SSL/TLS version ("ssl3", "tls1", "tls1.1", or "tls1.2"). 

The reference is here. This of course makes it very easy to test whether an update of TLS is the source of your problems.