2

I need to compile a tls scanning tool and I want to use OpenSSL1.1.0g. The tool uses the library and compiles it in the build file. Unfortunately the tool does not successfully build when my OpenSSL configuration does not explicitly enable ssl3-methods. When I configured OpenSSL with: enable-ssl3-method the tool successfully compile. I then tried to disable ssl3 so I have:

no-ssl3 enable-ssl3-method

It also compiles. I do not get the difference between the two. I need the tool not to negotiate TLS with SSLv3 and also not accept it if it is the only supported version by the server.

Can anyone clarify if this configuration ok? what is the difference between the two options? Will they prevent client support for SSLv3?

Unfortunately I can not even test the version by connecting to a SSLv3 server. The tool parse TLS 1.0 and TLS 1.1 as SSL3, but this is not an issue with me as long as it does not accept handshek with SSLv3.

1

The disable-ssl3 (or no-ssl3) option will prevent the SSL 3.0 protocol version from ever being negotiated in the library. This is done by default since OpenSSL 1.1.0 (but of course defaults can be changed).

The enable-ssl3-method option controls what part of the code will be built. If your legacy application links to the SSLv3_method function, then this option must be set if you want to use your legacy application unchanged. I believe that even with this option, no SSLv3.0 will be negotiated if disabled before with disable-ssl3.

Also note that the disable-ssl3-method option implies disable-ssl3.

Applications should use TLS_method instead of the more specific SSLv3_method, TLSv1_method, TLSv1_1_method, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.