diff options
| author | Ewoud Kohl van Wijngaarden <ewoud@kohlvanwijngaarden.nl> | 2024-01-05 15:58:59 +0100 |
|---|---|---|
| committer | git <svn-admin@ruby-lang.org> | 2024-01-17 16:41:47 +0000 |
| commit | 6213ab1a51387fd9cdcb5e87908722f3bbdf78cb (patch) | |
| tree | dddad16e41146eb21cfc5f6c82bafebf0a695ed5 /ext/openssl/lib/openssl/ssl.rb | |
| parent | 947194aacb3b82602eab63b92fbe5876f10c5640 (diff) | |
[ruby/openssl] Only set min_version on OpenSSL < 1.1.0
Both Red Hat and Debian-like systems configure the minimum TLS version
to be 1.2 by default, but allow users to change this via configs.
On Red Hat and derivatives this happens via crypto-policies[1], which in
writes settings in /etc/crypto-policies/back-ends/opensslcnf.config.
Most notably, it sets TLS.MinProtocol there. For Debian there's
MinProtocol in /etc/ssl/openssl.cnf. Both default to TLSv1.2, which is
considered a secure default.
In constrast, the SSLContext has a hard coded OpenSSL::SSL::TLS1_VERSION
for min_version. TLS 1.0 and 1.1 are considered insecure. By always
setting this in the default parameters, the system wide default can't be
respected, even if a developer wants to.
This takes the approach that's also done for ciphers: it's only set for
OpenSSL < 1.1.0.
[1]: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening
https://github.com/ruby/openssl/commit/ae215a47ae
Diffstat (limited to 'ext/openssl/lib/openssl/ssl.rb')
| -rw-r--r-- | ext/openssl/lib/openssl/ssl.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ext/openssl/lib/openssl/ssl.rb b/ext/openssl/lib/openssl/ssl.rb index ccc945f2f2..7e59400ccb 100644 --- a/ext/openssl/lib/openssl/ssl.rb +++ b/ext/openssl/lib/openssl/ssl.rb @@ -22,7 +22,6 @@ module OpenSSL module SSL class SSLContext DEFAULT_PARAMS = { # :nodoc: - :min_version => OpenSSL::SSL::TLS1_VERSION, :verify_mode => OpenSSL::SSL::VERIFY_PEER, :verify_hostname => true, :options => -> { @@ -55,6 +54,7 @@ ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== if !(OpenSSL::OPENSSL_VERSION.start_with?("OpenSSL") && OpenSSL::OPENSSL_VERSION_NUMBER >= 0x10100000) DEFAULT_PARAMS.merge!( + min_version: OpenSSL::SSL::TLS1_VERSION, ciphers: %w{ ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 |