Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set the TLS security level early and on context #685

Merged
merged 1 commit into from
May 6, 2020
Merged

Set the TLS security level early and on context #685

merged 1 commit into from
May 6, 2020

Commits on May 4, 2020

  1. Set the TLS security level early and on context 

    The existing code does work for cipher negotiation with old
(FortiOS 4?) FortiGate appliances, but not for personal certificates
(SHA-1 certificates).

Two reasons I can see:
* SSL_set_cipher_list() was called after messing with certificates.
* SSL_set_cipher_list() applies only to the SSL connection, not to
  certificates, call SSL_CTX_set_cipher_list() on context instead.

This change addresses both of the above issues.

See SSL(7) man page:
https://www.openssl.org/docs/man1.1.1/man7/ssl.html#DATA-STRUCTURES

SSL_CTX (SSL Context)
This is the global context structure which is created by a server or client once per program life-time and which holds mainly default values for the SSL structures which are later created for the connections.

SSL (SSL Connection)
This is the main SSL/TLS structure which is created by a server or client per established connection. This actually is the core structure in the SSL API. At run-time the application usually deals with this structure which has links to mostly all other structures.
    @DimitriPapadopoulos
    DimitriPapadopoulos committed May 4, 2020
    Configuration menu
    Copy the full SHA
    9d4ba91 View commit details
    Browse the repository at this point in the history