On Mon, 3 May 2021, Jeff King wrote:
I think it would also make sense to improve the documentation for
http.sslVersion to make it clear that this is a minimum (the current wording
is quite misleading).
While improving the http.sslVersion, maybe also consider dropping the special
mention of NSS and OpenSSL in there? Maybe just like this:
The SSL version to use when negotiating an SSL connection, if you
want to force the default. The available and default version
- depend on whether libcurl was built against NSS or OpenSSL and the
- particular configuration of the crypto library in use. Internally
+ depend on which TLS library libcurl was built to use. Internally
this sets the 'CURLOPT_SSL_VERSION' option; see the libcurl
documentation for more details on the format of this option and
for the ssl version supported. Currently the possible values of
Maybe also consider dropping 'sslv2' and 'sslv3' from the docs now since
virtually no TLS library supports them since several years now (as they're
considered insecure and bad) and therefor asking curl to use those will more
often than not rather cause an error.
--
/ daniel.haxx.se
