Pages fail to load on link click when using GC Wifi

[hillaryl]

Note: This is a relatively involved issue, with most of the complexity lying in the ability to coordinate and replicate the issue.

Issue: When connected to the internet via GC Wifi, website won't load at all when browsing in Chrome incognito mode, nor Firefox with the cache cleared.

• Chrome incognito returns Unsupported protocol error: "The client and server don't support a common SSL protocol version or cipher suite."
• Firefox returns SSL_ERROR_NO_CYPHER_OVERLAP (secure connection failed).

Website will load when using Chrome without the cache cleared, but inconsistently. Some links don't work, others do.

Can't seem to reproduce outside the GC Wifi network.

[anikbrazeau]

Possible similarity to previous bug/issue observed #129, maybe? 🤷‍♀️

[maxneuvians]

I think this is because GC WIFI does not support exclusively TLS 1.3 connections and requires TLS 1.2 to be available as well. That, however, was a problem in the past so this might have a different cause, although it does sound similar.

[CalvinRodo]

I think Max is correct, my best guess is that this is an issue with the devices that SSC is using for network monitoring and TLS 1.3, either the device doesn't support it or it's causing an issue with the way the devices do packet inspection.

[maxneuvians]

It does support TLS 1.2 but it does not support things like old IE and Safari, but there is something in the network that is using older cyphers

https://www.ssllabs.com/ssltest/analyze.html?d=learning%2dresources.cdssandbox.xyz&s=108.138.94.50&hideResults=on&latest

[emanelfy]

Further validation: I'm currently at the GC Co-working space in Toronto, and just tested out visiting the sub-pages + the language toggle to French and got the following errors:

[anikbrazeau]

Potential solution proposed in incident review (w/Daine, Clem, Eman):

Move away from cdssandbox.xyz domain --> alpha.canada.ca

[daine]

Grooming notes: This should fixed by

• 289

[ClementineHahn]

Product was migrated to new domain alpha.canada.ca #289 . It did resolve the issue