TLSv1, TLSv1_1 and TLSv1_2 are deprecated

[craff]

Two solutions: remove them or display a warning when the user use them ?

[craff]

I intend to propose a PR for that. It would be also nice to avoid the C warning about the same deprecation, because it may hide other warning (it takes quite a few line). If someone can assign me this issue!

[craff]

addressed by PR #115

[psafont]

After this PR, it's not clear to me how to create a context that allows both TLS 1.2 and TLS 1.3 without using the deprecated methods.

The way I'm currently using is:

let ctx = Ssl.(create_context SSLv23 Client_context) in
Ssl.(disable_protocols ctx [SSLv23; TLSv1; TLSv1_1])

Is there a better way to set them?

The manpages recommend against using versioned methods and instead of calling the set_min_proto_version:

TLS_method(), TLS_server_method(), TLS_client_method(), DTLS_method(), DTLS_server_method() and DTLS_client_method() are the version-flexible methods. All other methods only support one specific protocol version. Use the version-flexible methods instead of the version specific methods.

If you want to limit the supported protocols for the version flexible methods you can use SSL_CTX_set_min_proto_version(3), SSL_set_min_proto_version(3), SSL_CTX_set_max_proto_version(3) and SSL_set_max_proto_version(3) functions. Using these functions it is possible to choose e.g. TLS_server_method() and be able to negotiate with all possible clients, but to only allow newer protocols like TLS 1.0, TLS 1.1, TLS 1.2 or TLS 1.3.

https://www.openssl.org/docs/manmaster/man3/SSL_CTX_new.html

[anmonteiro]

Those functions are the new recommended way of setting them:

Here's an example: https://github.com/anmonteiro/piaf/blob/9ec58d0f03c2db2e783f81f816a9d7ee2200e623/lib/openssl.ml#L281-L286

[craff]

Hello, Pau Ruiz Safont ***@***.***> writes:

After this PR, it's not clear to me how to create a context that allows both TLS 1.2 and TLS 1.3 without using the deprecated methods. The way I'm currently using is: let ctx = Ssl.(create_context SSLv23 Client_context) in Ssl.(disable_protocols ctx [SSLv23; TLSv1; TLSv1_1]) Is there a better way to set them?

These are deprecated because one should not use them anymore. If you still want to support then, I would use the possibility to disable warning locally. Cheers, Christophe

…

The manpages recommend against using versioned methods and instead of calling the set_min_proto_version: TLS_method(), TLS_server_method(), TLS_client_method(), DTLS_method(), DTLS_server_method() and DTLS_client_method() are the version-flexible methods. All other methods only support one specific protocol version. Use the version-flexible methods instead of the version specific methods. If you want to limit the supported protocols for the version flexible methods you can use SSL_CTX_set_min_proto_version(3), SSL_set_min_proto_version(3), SSL_CTX_set_max_proto_version(3) and SSL_set_max_proto_version(3) functions. Using these functions it is possible to choose e.g. TLS_server_method() and be able to negotiate with all possible clients, but to only allow newer protocols like TLS 1.0, TLS 1.1, TLS 1.2 or TLS 1.3. https://www.openssl.org/docs/manmaster/man3/SSL_CTX_new.html — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were assigned.

-- Christophe Raffalli tél: +689 87 23 11 48 web: http://raffalli.eu my mails should pass DKIM/SPF tests/mes messages doivent passer les tests DKIM/SPF

[psafont]

Thanks for the pointer on how to use the new functions