Advisory: How to disable TLS1.0 and TLS1.1

[Longqin88888]

What should I do if I want to disable TLS 1.0 and TLS 1.0? Is there an interface to do it? I don't want TLS1.0 and TLS1.0 in the supported versions of the client and server, but I tried sslVersion set to MQTT_SSL_VERSION_TLS_1_2, TLS1.0 and TLS1.0 still exist in supported versions.

[jumoog]

Set the sslVersion on the Broker side

[Longqin88888]

Isn't there a way to do this on the client side?

[jumoog]

Yes, but you have to modify SSLSocket.c and set the minimum TLS version.

  SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);

[Longqin88888]

It is available after the modification according to your suggestion.
if(opts->sslVersion)
{
if(opts->sslVersion == MQTT_SSL_VERSION_DEFAULT || opts->sslVersion == MQTT_SSL_VERSION_TLS_1_0) {
SSL_CTX_set_min_proto_version(net->ctx, TLS1_VERSION);
}else if(opts->sslVersion == MQTT_SSL_VERSION_TLS_1_1) {
SSL_CTX_set_min_proto_version(net->ctx, TLS1_1_VERSION);
} else if (opts->sslVersion == MQTT_SSL_VERSION_TLS_1_2) {
SSL_CTX_set_min_proto_version(net->ctx, TLS1_2_VERSION);
}
}

[Longqin88888]

Is there any consideration to add this function? I see that when using openssl1.1.0 or below, the client can disable TLS1.0 and 1.1 by sslVersion, but if using openssl1.1.0 or above, this parameter is invalid on the client.
#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
net->ctx = SSL_CTX_new(TLS_client_method());
#else
int sslVersion = MQTT_SSL_VERSION_DEFAULT;
if (opts->struct_version >= 1) sslVersion = opts->sslVersion;
/* SSL_OP_NO_TLSv1_1 is defined in ssl.h if the library version supports TLSv1.1.

• OPENSSL_NO_TLS1 is defined in opensslconf.h or on the compiler command line
• if TLS1.x was removed at OpenSSL library build time via Configure options.
  /
  switch (sslVersion)
  {
  case MQTT_SSL_VERSION_DEFAULT:
  net->ctx = SSL_CTX_new(SSLv23_client_method()); / SSLv23 for compatibility with SSLv2, SSLv3 and TLSv1 */
  break;
  #if defined(SSL_OP_NO_TLSv1) && !defined(OPENSSL_NO_TLS1)
  case MQTT_SSL_VERSION_TLS_1_0:
  net->ctx = SSL_CTX_new(TLSv1_client_method());
  break;
  #endif
  #if defined(SSL_OP_NO_TLSv1_1) && !defined(OPENSSL_NO_TLS1)
  case MQTT_SSL_VERSION_TLS_1_1:
  net->ctx = SSL_CTX_new(TLSv1_1_client_method());
  break;
  #endif
  #if defined(SSL_OP_NO_TLSv1_2) && !defined(OPENSSL_NO_TLS1)
  case MQTT_SSL_VERSION_TLS_1_2:
  net->ctx = SSL_CTX_new(TLSv1_2_client_method());
  break;
  #endif
  default:
  break;
  }