Hi, Can you try this option SSL_CTX_set_options(m_SslCtx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3); instead of disabling using the cipher list regards, James Arivazhagan On Tue, Apr 7, 2015 at 5:41 AM, David Rueter <drueter at assyst.com> wrote: > I would like to disable SSL3 (to prevent POODLE attacks), but I would like > to leave TLS1 enabled (particularly DES-CBC3-SHA, AES128-SHA and > AES256-SHA). > > > > However disabling SSL3 with !SSLv3 disables TLSv1 also. Furthermore, > disabling SSL3 with -SSLv3 then adding in individual ciphers such as > +DES-CBC3-SHA seems to re-enable SSLv3. > > > > In looking at https://www.openssl.org/docs/apps/ciphers.html it looks > like SSL_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA are > both referred to as DES-CBC3-SHA. > > > > Is this intentional? Are not SSL_RSA_WITH_3DES_EDE_CBC_SHA and > TLS_RSA_WITH_3DES_EDE_CBC_SHA different ciphers? > > > > Is there no way to disable SSL3 while leaving > TLS_RSA_WITH_3DES_EDE_CBC_SHA enabled? > > > > _______________________________________________ > openssl-users mailing list > To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users > > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20150407/049108a7/attachment-0001.html>
