[openssl-users] Disable SSL3 and enable TLS1? / Ambiguous "DES-CBC3-SHA"

[James]

Hi,
Can you try this option

SSL_CTX_set_options(m_SslCtx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);

instead of disabling using the cipher list




regards,

James Arivazhagan



On Tue, Apr 7, 2015 at 5:41 AM, David Rueter <drueter at assyst.com> wrote:

> I would like to disable SSL3 (to prevent POODLE attacks), but I would like
> to leave TLS1 enabled (particularly DES-CBC3-SHA, AES128-SHA and
> AES256-SHA).
>
>
>
> However disabling SSL3 with !SSLv3 disables TLSv1 also.  Furthermore,
> disabling SSL3 with -SSLv3 then adding in individual ciphers such as
> +DES-CBC3-SHA seems to re-enable SSLv3.
>
>
>
> In looking at https://www.openssl.org/docs/apps/ciphers.html it looks
> like SSL_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA are
> both referred to as DES-CBC3-SHA.
>
>
>
> Is this intentional? Are not SSL_RSA_WITH_3DES_EDE_CBC_SHA and
> TLS_RSA_WITH_3DES_EDE_CBC_SHA different ciphers?
>
>
>
> Is there no way to disable SSL3 while leaving
> TLS_RSA_WITH_3DES_EDE_CBC_SHA enabled?
>
>
>
> _______________________________________________
> openssl-users mailing list
> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20150407/049108a7/attachment-0001.html>