CODEWITHSUNDEEP
sslopensslgsoap
user141249
user141249

Reputation:

Globally disabling protocols in OpenSSL

Is it possible to globally disable TLS 1.1 for an application that is indirectly using OpenSSL?

I would like to disable TLS 1.1 for a C application that makes soap HTTPS calls using gSOAP. Disabling TLS 1.1 fixes a intermittent SSL connection problem I have been experiencing for the last few days (SSL routines:SSL3_GET_RECORD:wrong version number).

Currently TLS 1.1 is disabled by using a custom build of gSOAP but ideally I would like to disable the protocol using a config file or some code in my application.

Ubuntu 12.04.5 LTS

OpenSSL 1.0.1-4ubuntu5.20

gSOAP 2.8.4-2

Upvotes: 1

Views: 1414

Answers (2)

Dr. Alex RE
Dr. Alex RE

Reputation: 1698

At a minimum you will need gSOAP 2.8.28. Use the SOAP_TLSv1_2 option with soap_ssl_client_context() and soap_ssl_server_context() to restrict the TLS protocol to TLSv1.2 only. TLS1.0/TLS1.1/SSLv3 are disabled. You can't combine the SSL/TLS protocol options, so only TLSv1.2 will be enabled with this option. This works with OpenSSL 1.0.1 or later and recent GNUTLS versions. Perhaps there will be new options in upcoming gSOAP releases to support subsets of protocols, which would be nice.

Upvotes: 0

Steffen Ullrich
Steffen Ullrich

Reputation: 123320

Although there is a global OpenSSL config file it can not be used to restrict the default SSL version(s). And unfortunately there seems to be no API or configuration for the gSOAP library to restrict the SSL version. So you must probably live with your custom build version and hope that someday they provide an API to set the SSL version.

Upvotes: 1

Related Questions