Changeset 82e55d2

Timestamp:

2016-09-29T17:53:41Z (8 years ago)

Author:

dequis <dx@…>

Branches:

master

Children:

58d285a

Parents:

ff468a7

Message:

ssl_openssl: Allow TLS versions newer than 1.0

Another victim of SSLv23_client_method's terrible name. At least we
weren't forcing ssl 3.0.

Thanks kl3 for pointing this out.

Despite what this commit might suggest, using openssl is not recommended
at all. Potential GPL incompatibility aside, that module doesn't have
certificate verification code. Don't use it unless you have a good
reason to do so.

File:

• lib/ssl_openssl.c (modified) (1 diff)

lib/ssl_openssl.c

@@ -67 +67 @@
         SSL_library_init();
 
-        meth = TLSv1_client_method();
+        meth = SSLv23_client_method();
         ssl_ctx = SSL_CTX_new(meth);
+        SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
 
         initialized = TRUE;