[openssl-users] Disable SSL3 and enable TLS1? / Ambiguous "DES-CBC3-SHA"

[David Rueter]

James, thanks for the reply.

 

At this point I am using compiled Windows binaries, and am running a compiled Windows application that uses the SSL DLLs.  The Windows application does let me specify a cipher list, but I do not have source to that application to re-build.

 

I don’t think that in this situation I am able to call SSL_CTX_set_options.

 

I guess I might be stuck if I can’t use the cipher list to disable SSL3 while leaving TLS1 enabled.  Not the end of the world, but not ideal.

 

Sincerely,

 

David Rueter

 

 

From: openssl-users [mailto:openssl-users-bounces at openssl.org] On Behalf Of James
Sent: Monday, April 06, 2015 6:45 PM
To: openssl-users at openssl.org
Subject: Re: [openssl-users] Disable SSL3 and enable TLS1? / Ambiguous "DES-CBC3-SHA"

 

Hi, 

Can you try this option

SSL_CTX_set_options(m_SslCtx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);

instead of disabling using the cipher list

 

 

 

regards,

James Arivazhagan

 

 

On Tue, Apr 7, 2015 at 5:41 AM, David Rueter <drueter at assyst.com <mailto:drueter at assyst.com> > wrote:

I would like to disable SSL3 (to prevent POODLE attacks), but I would like to leave TLS1 enabled (particularly DES-CBC3-SHA, AES128-SHA and AES256-SHA).

 

However disabling SSL3 with !SSLv3 disables TLSv1 also.  Furthermore, disabling SSL3 with -SSLv3 then adding in individual ciphers such as +DES-CBC3-SHA seems to re-enable SSLv3.

 

In looking at https://www.openssl.org/docs/apps/ciphers.html it looks like SSL_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA are both referred to as DES-CBC3-SHA.

 

Is this intentional? Are not SSL_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA different ciphers?

 

Is there no way to disable SSL3 while leaving TLS_RSA_WITH_3DES_EDE_CBC_SHA enabled?

 


_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20150406/b853fb50/attachment.html>