Vercel servers reject TLS handshake ClientHello messages when ec_point_formats extension is absent

[dkg]

Summary

Over on RIPE-NCC/ripe-atlas-probe-measurements#15 I observed that RIPE Atlas's client probes for TLS handshakes fail against Vercel servers, apparently because the ClientHello from a probe does not offer the ec_point_formats TLS extension.

I tested this by looking at the https://vercel.com/ servers, which presumably are themselves running behind Vercel (their HTTP Server: header says Vercel at any rate).

There's no reason i can see for Vercel's servers to reject a TLS ClientHello when it lacks ec_point_formats, especially since they are TLS 1.3 compliant and TLS 1.3 explicitly deprecates the ec_point_formats extension.

Additional information

No response

Example

No response