From a9dcd228875a40ef2b475ff6f328332bd6f6e4f6 Mon Sep 17 00:00:00 2001 From: Andrew Clemons Date: Thu, 5 May 2016 12:56:52 +1200 Subject: [PATCH] --tls-config 3 only enabled SSLv3 This flag is meant to enable SSLv3 and any later protocol but actually only enabled SSLv3. https://www.openssl.org/docs/man1.0.1/ssl/SSLv3_method.html --- src/gssl/gssl_openssl.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/gssl/gssl_openssl.cpp b/src/gssl/gssl_openssl.cpp index f64ad94..f8a225f 100644 --- a/src/gssl/gssl_openssl.cpp +++ b/src/gssl/gssl_openssl.cpp @@ -292,9 +292,10 @@ GSsl::Context::Context( const std::string & pem_file , unsigned int flags ) { if( (flags&3U) == 2U ) m_ssl_ctx = SSL_CTX_new(SSLv23_method()) ; - else if( (flags&3U) == 3U ) - m_ssl_ctx = SSL_CTX_new(SSLv3_method()) ; - else { + else if( (flags&3U) == 3U ) { + m_ssl_ctx = SSL_CTX_new(SSLv23_method()) ; + SSL_CTX_set_options(m_ssl_ctx, SSL_OP_NO_SSLv2) ; + } else { m_ssl_ctx = SSL_CTX_new(SSLv23_method()) ; SSL_CTX_set_options(m_ssl_ctx, SSL_OP_NO_SSLv2| SSL_OP_NO_SSLv3) ; }