I need to compile a tls scanning tool and I want to use OpenSSL1.1.0g. The tool uses the library and compiles it in the build file. Unfortunately the tool does not successfully build when my OpenSSL configuration does not explicitly enable
ssl3-methods. When I configured OpenSSL with:
enable-ssl3-method the tool successfully compile. I then tried to disable ssl3 so I have:
It also compiles. I do not get the difference between the two. I need the tool not to negotiate TLS with SSLv3 and also not accept it if it is the only supported version by the server.
Can anyone clarify if this configuration ok? what is the difference between the two options? Will they prevent client support for SSLv3?
Unfortunately I can not even test the version by connecting to a SSLv3 server. The tool parse TLS 1.0 and TLS 1.1 as SSL3, but this is not an issue with me as long as it does not accept handshek with SSLv3.