Allow fallback to SSL 3.0 (Internet Explorer)
This machine-wide registry value controls whether Internet Explorer may retry a connection with SSL 3.0 or an older enabled protocol after an attempt using TLS 1.0 or later fails.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableSSL3Fallback
This machine-wide registry value controls whether Internet Explorer may retry a connection with SSL 3.0 or an older enabled protocol after an attempt using TLS 1.0 or later fails.
EnableSSL3Fallback is a REG_DWORD value for which the administrative template defines these meanings:
0: Do not allow insecure fallback.1: Allow fallback only for websites or security zones where Internet Explorer Protected Mode is not active.3: Allow fallback both inside and outside Protected Mode, and therefore for all websites.
If the value is not imposed by the policy, Internet Explorer uses the system default.
Notes
Security
Allowing fallback creates a downgrade path from TLS to the obsolete SSL 3.0 protocol. Under suitable conditions, an attacker in a man-in-the-middle position could disrupt TLS negotiation, cause the browser to use SSL 3.0, and exploit known weaknesses in that protocol. This can expose portions of encrypted traffic, such as authentication cookies.
The value does not enable SSL 3.0 itself or change which security protocols are enabled in Internet Explorer or Windows. Fallback can occur only if the relevant older protocol is available through other settings.
Possible side effects
Blocking fallback entirely can prevent access to legacy websites or servers when TLS negotiation fails and the server can communicate only through SSL 3.0 or an older protocol. With a value of 1, compatibility also depends on whether Protected Mode is active for the applicable Internet Explorer security zone.
Notes
This is a machine-scoped Internet Explorer administrative-template setting. It is not a system-wide Schannel protocol switch and does not automatically change protocol behavior in other applications.
Microsoft documentation
Microsoft Learn: InternetExplorer Policy CSP – AllowFallbackToSSL3