ssl: dump the SSL ciphers in favour of TLS #2625
Conversation
|
Gah, yes, these should definitely be disabled. What do you think about also adding |
|
That makes sense, putting compression on this level of the stack seems silly at best. |
|
My copy of OpenSSL on the Mac does not have |
|
My OpenSSL (Ubuntu Wheezy) defines it - I suspect it's been removed in newer OpenSSL versions. (Though isn't Apple's OpenSSL a wrapper around SecureTransport? I forget.) It would be nice to ifdef this - I think disabling compression (if possible) would be helpful? |
|
Sigh. Indeed I meant Debian Wheezy, further confirming that Microsofties don't know anything about Linux. |
All versions of SSL are considered deprecated now, so let's ask OpenSSl to only use TLSv1. We still ask it to load those ciphers for compatibility with servers which want to use an older hello but will use TLS for encryption. For good measure we also disable compression, which can be exploitable, if the OpenSSL version supports it.
|
There you go, compression disabled where OpenSSL knows about it. |
ssl: dump the SSL ciphers in favour of TLS
|
Awesome. |
All versions of SSL are considered deprecated now, so let's ask OpenSSl
to only use TLSv1. We still ask it to load those ciphers for
compatibility with servers which want to use an older hello but will use
TLS for encryption.
This should also go into the maintenance release IMHO.