<div dir="ltr">Hi, <div>Can you try this option</div><div><p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas">SSL_CTX_set_options(m_SslCtx,
SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);</span></p><p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas">instead of disabling using the cipher list</span></p><p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"><br></span></p><p class="MsoNormal"><br></p><p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"><br></span></p><p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas">regards,</span></p><p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas">James Arivazhagan</span></p><p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"><br></span></p></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Apr 7, 2015 at 5:41 AM, David Rueter <span dir="ltr"><<a href="mailto:drueter@assyst.com" target="_blank">drueter@assyst.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="#0563C1" vlink="#954F72"><div><p class="MsoNormal">I would like to disable SSL3 (to prevent POODLE attacks), but I would like to leave TLS1 enabled (particularly DES-CBC3-SHA, AES128-SHA and AES256-SHA).<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">However disabling SSL3 with !SSLv3 disables TLSv1 also.  Furthermore, disabling SSL3 with -SSLv3 then adding in individual ciphers such as +DES-CBC3-SHA seems to re-enable SSLv3.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">In looking at <a href="https://www.openssl.org/docs/apps/ciphers.html" target="_blank">https://www.openssl.org/docs/apps/ciphers.html</a> it looks like SSL_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA are both referred to as DES-CBC3-SHA.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Is this intentional? Are not SSL_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA different ciphers?<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Is there no way to disable SSL3 while leaving TLS_RSA_WITH_3DES_EDE_CBC_SHA enabled?<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p></div></div><br>_______________________________________________<br>
openssl-users mailing list<br>
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
<br></blockquote></div><br></div></div>