0

How can I identify the versions (TLSv1.2, TLSv1.1, TLSv1.0, SSLv3, etc.) supported in OpenSSL1.1.0g when I manually compile it from its source (NOT the one shipped with the OS like ubuntu) without explicit disabling any version in the compilation?

Q: Is SSLv3 supported by default in OpenSSL1.1.0g? How can I know this?

2

The test program openssl s_server has several option to choose the SSL/TLS version, i.e. -ssl2, -ssl3, -tls1, -tls1_1, .... Starting with OpenSSL 1.1.0 the usage openssl s_server -help shows all actually supported options, i.e. -ssl3 is only shown if SSLv3 is actually supported.
With earlier versions of OpenSSL the usage might show version which were not actually supported but an attempt to actually use these resulted in an error.

Q: Is SSLv3 supported by default in OpenSSL1.1.0g? How can I know this?

Since you compile it from source you can just look at the output from config:

$ ./config
...
Configuring OpenSSL version 1.1.0g-dev (0x10100070L)
...
    no-ssl3         [default]  OPENSSL_NO_SSL3

Thus, it looks like SSLv3 is disabled by default.

  • I did openssl s_server -help and I get option: -no_ssl3. Does this meand ssl3 is supported? In the same time, there is no option to just talk ssl3, while there are options to just talk tls1, tls1_1, etc. Is there any reliable way through whcih I know which versions are supported by default? Unfortunately it is difficult to know as ssl3 not supported by many servers to test connecting to them, and TLS does send the max. version so its hard to tell the min. – user9371654 Oct 3 '18 at 12:25
  • @user9371654: The -no_ssl3 etc options are not relevant for this. If you don't have a -ssl3 option then you don't have support for SSLv3. – Steffen Ullrich Oct 3 '18 at 12:29
  • If I have it already installed in my system, can I run the ./config to check that I am having it disabled without affecting anything? – user9371654 Oct 3 '18 at 12:35
  • it is working with me & I do not want to recompile or reconfigure it. I have made custom configurations before., Will ./config restore the default? Not sure the ./config will perform anything that changes my current installation? sorry but I'm not a linux user. – user9371654 Oct 3 '18 at 12:46
  • 1
    For completeness, below 1.1.0 there isn't an actual -help option, but any invalid option gives the usage message -- including -help or -zowie or -???????? – dave_thompson_085 Oct 4 '18 at 2:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.