Re: Weird SSLProtocol issue (Apache Users)

Hi,

OK, forget the question. I found this in the OpenSSL-1.1.1 man pages

The Protocol command is fragile and deprecated; do not use it. Use MinProtocol and MaxProtocol instead. If you do use Protocol, make sure that the resulting range of enabled protocols has no "holes", e.g. if TLS 1.0 and TLS 1.2 are both enabled, make sure to also leave TLS 1.1 enabled.

Apparently this changed from 1.0.2 and I can no longer have TLSv1.0 without also enabling TLSv1.1. Time to beat up the old clients harder.

Sorry for the noise

Martin

On Wed, Oct 21, 2020 at 11:37 PM Martin Knoblauch <knobi@xxxxxxxxxxxx> wrote:

Hi,

the setup is httpd-2.4.46 with OpenSSL-1.1.1g. The goal is to support the following SSL protocols:

TLS1.3
TLS1.2
TLS1 -- for some legacy reason

So I have specified:

SSLProtocol +TLSv1 +TLSv1.2 +TLSv1.3

Using "sslscan" I get:

SSL/TLS Protocols:
SSLv2 disabled
SSLv3 disabled
TLSv1.0 disabled
TLSv1.1 disabled
TLSv1.2 enabled
TLSv1.3 enabled

If I use

SSLProtocol +TLSv1 -TLSv1.1 +TLSv1.2 +TLSv1.3

There is the same result. I can get 1.0 only if I explicitly enable 1.1

SSLProtocol +TLSv1 +TLSv1.1 +TLSv1.2 +TLSv1.3

resulting in

SSL/TLS Protocols:
SSLv2 disabled
SSLv3 disabled
TLSv1.0 enabled
TLSv1.1 enabled
TLSv1.2 enabled
TLSv1.3 enabled

which is not what I want. So, any ideas? Am I doing something wrong?

Cheers
Martin
--
------------------------------------------------------
Martin Knoblauch
email: k n o b i AT knobisoft DOT de
www: http://www.knobisoft.de