--- a/toolkit/mozapps/extensions/internal/ProductAddonChecker.jsm
+++ b/toolkit/mozapps/extensions/internal/ProductAddonChecker.jsm
@@ -37,25 +37,28 @@ Cu.import("resource://gre/modules/osfile
 XPCOMUtils.defineLazyModuleGetter(this, "GMPPrefs",
                                   "resource://gre/modules/GMPUtils.jsm");
 
 /* globals OS */
 
 XPCOMUtils.defineLazyModuleGetter(this, "UpdateUtils",
                                   "resource://gre/modules/UpdateUtils.jsm");
 
-var logger = Log.repository.getLogger("addons.productaddons");
+XPCOMUtils.defineLazyModuleGetter(this, "ServiceRequest",
+                                  "resource://gre/modules/ServiceRequest.jsm");
 
 // This exists so that tests can override the XHR behaviour for downloading
 // the addon update XML file.
 var CreateXHR = function() {
   return Cc["@mozilla.org/xmlextras/xmlhttprequest;1"].
     createInstance(Ci.nsISupports);
 }
 
+var logger = Log.repository.getLogger("addons.productaddons");
+
 /**
  * Number of milliseconds after which we need to cancel `downloadXML`.
  *
  * Bug 1087674 suggests that the XHR we use in `downloadXML` may
  * never terminate in presence of network nuisances (e.g. strange
  * antivirus behavior). This timeout is a defensive measure to ensure
  * that we fail cleanly in such case.
  */
@@ -107,16 +110,21 @@ function downloadXML(url, allowNonBuiltI
       request = request.wrappedJSObject;
     }
     request.open("GET", url, true);
     request.channel.notificationCallbacks = new BadCertHandler(allowNonBuiltIn);
     // Prevent the request from reading from the cache.
     request.channel.loadFlags |= Ci.nsIRequest.LOAD_BYPASS_CACHE;
     // Prevent the request from writing to the cache.
     request.channel.loadFlags |= Ci.nsIRequest.INHIBIT_CACHING;
+    // Use conservative TLS settings. See bug 1325501.
+    // TODO move to ServiceRequest.
+    if (request.channel instanceof Ci.nsIHttpChannelInternal) {
+      request.channel.QueryInterface(Ci.nsIHttpChannelInternal).beConservative = true;
+    }
     request.timeout = TIMEOUT_DELAY_MS;
 
     request.overrideMimeType("text/xml");
     // The Cache-Control header is only interpreted by proxies and the
     // final destination. It does not help if a resource is already
     // cached locally.
     request.setRequestHeader("Cache-Control", "no-cache");
     // HTTP/1.0 servers might not implement Cache-Control and
@@ -157,17 +165,17 @@ function downloadXML(url, allowNonBuiltI
     logger.info("sending request to: " + url);
     request.send(null);
   });
 }
 
 function downloadJSON(uri) {
   logger.info("fetching config from: " + uri);
   return new Promise((resolve, reject) => {
-    let xmlHttp = new XMLHttpRequest({mozAnon: true});
+    let xmlHttp = new ServiceRequest({mozAnon: true});
 
     xmlHttp.onload = function(aResponse) {
       resolve(JSON.parse(this.responseText));
     };
 
     xmlHttp.onerror = function(e) {
       reject("Fetching " + uri + " results in error code: " + e.target.status);
     };
@@ -284,18 +292,17 @@ function downloadLocalConfig() {
  *
  * @param  url
  *         The url to download from.
  * @return a promise that resolves to the path of a temporary file or rejects
  *         with a JS exception in case of error.
  */
 function downloadFile(url) {
   return new Promise((resolve, reject) => {
-    let xhr = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"].
-                  createInstance(Ci.nsISupports);
+    let xhr = new XMLHttpRequest();
     xhr.onload = function(response) {
       logger.info("downloadXHR File download. status=" + xhr.status);
       if (xhr.status != 200 && xhr.status != 206) {
         reject(Components.Exception("File download failed", xhr.status));
         return;
       }
       Task.spawn(function* () {
         let f = yield OS.File.openUnique(OS.Path.join(OS.Constants.Path.tmpDir, "tmpaddon"));
@@ -317,16 +324,21 @@ function downloadFile(url) {
       reject(ex);
     };
     xhr.addEventListener("error", fail);
     xhr.addEventListener("abort", fail);
 
     xhr.responseType = "arraybuffer";
     try {
       xhr.open("GET", url);
+      // Use conservative TLS settings. See bug 1325501.
+      // TODO move to ServiceRequest.
+      if (xhr.channel instanceof Ci.nsIHttpChannelInternal) {
+        xhr.channel.QueryInterface(Ci.nsIHttpChannelInternal).beConservative = true;
+      }
       xhr.send(null);
     } catch (ex) {
       reject(ex);
     }
   });
 }
 
 /**
@@ -413,16 +425,21 @@ const ProductAddonChecker = {
    * @param  allowedCerts
    *         The list of certificate attributes to match the SSL certificate
    *         against or null to skip checks.
    * @return a promise that resolves to an object containing the list of add-ons
    *         and whether the local fallback was used, or rejects with a JS
    *         exception in case of error.
    */
   getProductAddonList(url, allowNonBuiltIn = false, allowedCerts = null) {
+    if (!GMPPrefs.get(GMPPrefs.KEY_UPDATE_ENABLED, true)) {
+      logger.info("Updates are disabled via media.gmp-manager.updateEnabled");
+      return Promise.resolve({usedFallback: true, gmpAddons: []});
+    }
+
     return downloadXML(url, allowNonBuiltIn, allowedCerts)
       .then(parseXML)
       .catch(downloadLocalConfig);
   },
 
   /**
    * Downloads an add-on to a local file and checks that it matches the expected
    * file. The caller is responsible for deleting the temporary file returned.