TLS 1.3 client should set legacy_record_version to TLS 1.2 after Hello Retry Request
$ wget https://download.pureftpd.org/pub/ucarp/ucarp-1.5.2.tar.gz --debug
DEBUG output created by Wget 1.20.3 on linux-gnu.
Reading HSTS entries from /folk/myu2/.wget-hsts
Converted file name 'ucarp-1.5.2.tar.gz' (UTF-8) -> 'ucarp-1.5.2.tar.gz' (UTF-8)
--2020-07-17 05:48:34-- https://download.pureftpd.org/pub/ucarp/ucarp-1.5.2.tar.gz
Certificates loaded: 256
Resolving download.pureftpd.org... 37.59.238.213
Caching download.pureftpd.org => 37.59.238.213
Connecting to download.pureftpd.org|37.59.238.213|:443... connected.
Created socket 3.
Releasing 0x000055880ec87460 (new refcount 1).
GnuTLS: A TLS fatal alert has been received.
GnuTLS: received alert [70]: Error in protocol version
Closed fd 3
Unable to establish SSL connection.
$ wget --secure-protocol=TLSv1_2 https://download.pureftpd.org/pub/ucarp/ucarp-1.5.2.tar.gz
--2020-07-17 07:07:08-- https://download.pureftpd.org/pub/ucarp/ucarp-1.5.2.tar.gz
Resolving download.pureftpd.org... 37.59.238.213
Connecting to download.pureftpd.org|37.59.238.213|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 429089 (419K) [text/plain]
Saving to: 'ucarp-1.5.2.tar.gz'
ucarp-1.5.2.tar.gz 100%[===================>] 419.03K 432KB/s in 1.0s
2020-07-17 07:07:16 (432 KB/s) - 'ucarp-1.5.2.tar.gz' saved [429089/429089]
$ gnutls-cli -V 37.59.238.213
Processed 126 CA certificate(s).
Resolving '37.59.238.213:443'... Connecting to '37.59.238.213:443'...
*** Fatal error: A TLS fatal alert has been received.
*** Received alert [70]: Error in protocol version
$ gnutls-cli --version
gnutls-cli 3.6.14
Copyright (C) 2000-2020 Free Software Foundation, and others, all rights reserved.
This is free software. It is licensed for use, modification and
redistribution under the terms of the GNU General Public License,
version 3 or later http://gnu.org/licenses/gpl.html
Please send bug reports to: bugs@gnutls.org