When we've downgraded a connection, we treat the inappropriate_fallback TLS alert as fatal and report that as the cause of the problem. In most cases however, the reason that this is encountered (aside from actual occurrences of thwarted downgrade attacks), is some other error that triggered our TLS version intolerance logic. See bug 1072382 for an example. We could consider saving and surfacing the original error instead, which is more likely to be correct. That is, unless there is an active attack. It could also be handled more cleanly at upper layers (with reload and try again pages and the like).