Hello,
I?ve made several attempts to compile various versions of OpenSSL, the
latest being 1.0.2d for Win32. Although many attempts to compile have been
successful and the dlls (and .exe) usable, I have not been able to
successfully disable SSLv3.
I attempted on a Windows 7 box using VC 2010, I can compile without no-ssl2
no-ssl3, however, when I try to use no-ssl3, I end up getting linker errors.
I notice that the ssleay32.def still has references to SSLv3 and SSLv23.
When I attempt to remove these and try to compile again, it continues to
fail.
When I could not make this work, I switched to ubuntu and did a cross
compile using mingw. In this case I can pass no-ssl2 and no-ssl3 (I even
tried disable-ssl2 disable-ssl3 disable-ssl3-method) and it all compiles
fine. However, when I scan the application that is using the port, I can
still see SSLv3 is used (accepted for a few ciphers):
Rejected SSLv3 256 bits ADH-AES256-SHA
Rejected SSLv3 256 bits DHE-RSA-AES256-SHA
Rejected SSLv3 256 bits DHE-DSS-AES256-SHA
Accepted SSLv3 256 bits AES256-SHA
Rejected SSLv3 128 bits ADH-AES128-SHA
Rejected SSLv3 128 bits DHE-RSA-AES128-SHA
Rejected SSLv3 128 bits DHE-DSS-AES128-SHA
Accepted SSLv3 128 bits AES128-SHA
Rejected SSLv3 168 bits ADH-DES-CBC3-SHA
Rejected SSLv3 56 bits ADH-DES-CBC-SHA
Rejected SSLv3 40 bits EXP-ADH-DES-CBC-SHA
Rejected SSLv3 128 bits ADH-RC4-MD5
Rejected SSLv3 40 bits EXP-ADH-RC4-MD5
Rejected SSLv3 168 bits EDH-RSA-DES-CBC3-SHA
Rejected SSLv3 56 bits EDH-RSA-DES-CBC-SHA
Rejected SSLv3 40 bits EXP-EDH-RSA-DES-CBC-SHA
Rejected SSLv3 168 bits EDH-DSS-DES-CBC3-SHA
Rejected SSLv3 56 bits EDH-DSS-DES-CBC-SHA
Rejected SSLv3 40 bits EXP-EDH-DSS-DES-CBC-SHA
Accepted SSLv3 168 bits DES-CBC3-SHA
Rejected SSLv3 56 bits DES-CBC-SHA
Rejected SSLv3 40 bits EXP-DES-CBC-SHA
Rejected SSLv3 128 bits IDEA-CBC-SHA
Rejected SSLv3 40 bits EXP-RC2-CBC-MD5
Rejected SSLv3 128 bits RC4-SHA
Rejected SSLv3 128 bits RC4-MD5
Rejected SSLv3 40 bits EXP-RC4-MD5
Rejected SSLv3 0 bits NULL-SHA
Rejected SSLv3 0 bits NULL-MD5
Is there a bug for windows that prevents generating dlls that do not support
sslv3?
If anyone has been able to compile it and confirmed no ssl3, I would really
appreciate any guidance (and a copy of your ssleay32,dll, libeay32.dll, and
openssl.exe).
Thanks in advance.
Jay
----
Jay A Trombley, PMP
Office : +1 (802) 458-0814
Mobile : +1 (415) 238.4780
Fax : +1 (802) 329.2064
Skype : jay.trombley
Web : http://www.linkedin.com/in/jaytrombley
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20150714/031ee460/attachment.html>
