Re: http.sslVersion only specifies minimum TLS version, later versions are allowed

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, 3 May 2021, Jeff King wrote:

I think it would also make sense to improve the documentation for http.sslVersion to make it clear that this is a minimum (the current wording is quite misleading).

While improving the http.sslVersion, maybe also consider dropping the special mention of NSS and OpenSSL in there? Maybe just like this:

        The SSL version to use when negotiating an SSL connection, if you
        want to force the default.  The available and default version
-       depend on whether libcurl was built against NSS or OpenSSL and the
-       particular configuration of the crypto library in use. Internally
+       depend on which TLS library libcurl was built to use. Internally
        this sets the 'CURLOPT_SSL_VERSION' option; see the libcurl
        documentation for more details on the format of this option and
        for the ssl version supported. Currently the possible values of

Maybe also consider dropping 'sslv2' and 'sslv3' from the docs now since virtually no TLS library supports them since several years now (as they're considered insecure and bad) and therefor asking curl to use those will more often than not rather cause an error.

--

 / daniel.haxx.se



[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]

  Powered by Linux