I would like to disable SSL3 (to prevent POODLE attacks), but I would like to leave TLS1 enabled (particularly DES-CBC3-SHA, AES128-SHA and AES256-SHA). However disabling SSL3 with !SSLv3 disables TLSv1 also. Furthermore, disabling SSL3 with -SSLv3 then adding in individual ciphers such as +DES-CBC3-SHA seems to re-enable SSLv3. In looking at https://www.openssl.org/docs/apps/ciphers.html it looks like SSL_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA are both referred to as DES-CBC3-SHA. Is this intentional? Are not SSL_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA different ciphers? Is there no way to disable SSL3 while leaving TLS_RSA_WITH_3DES_EDE_CBC_SHA enabled? -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20150406/2aea746c/attachment.html>
