diff options
| author | Jay Satiro <raysatiro@yahoo.com> | 2014-10-24 13:41:56 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2014-10-24 13:41:56 +0200 |
| commit | ec783dc142129d3860e542b443caaa78a6172d56 (patch) | |
| tree | 7062b5f480575be59252816c9877823fbde143c9 /lib/vtls/nss.c | |
| parent | 2b042574917aeff4d366dec23a7d007913cbe755 (diff) | |
SSL: Remove SSLv3 from SSL default due to POODLE attack
- Remove SSLv3 from SSL default in darwinssl, schannel, cyassl, nss,
openssl effectively making the default TLS 1.x. axTLS is not affected
since it supports only TLS, and gnutls is not affected since it already
defaults to TLS 1.x.
- Update CURLOPT_SSLVERSION doc
Diffstat (limited to 'lib/vtls/nss.c')
| -rw-r--r-- | lib/vtls/nss.c | 9 |
1 files changed, 1 insertions, 8 deletions
diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c index ebf7fb2fa..d7dd98055 100644 --- a/lib/vtls/nss.c +++ b/lib/vtls/nss.c @@ -1345,15 +1345,8 @@ static CURLcode nss_init_sslver(SSLVersionRange *sslver, switch (data->set.ssl.version) { default: case CURL_SSLVERSION_DEFAULT: - sslver->min = SSL_LIBRARY_VERSION_3_0; - if(data->state.ssl_connect_retry) { - infof(data, "TLS disabled due to previous handshake failure\n"); - sslver->max = SSL_LIBRARY_VERSION_3_0; - return CURLE_OK; - } - /* intentional fall-through to default to highest TLS version if possible */ - case CURL_SSLVERSION_TLSv1: + sslver->min = SSL_LIBRARY_VERSION_TLS_1_0; #ifdef SSL_LIBRARY_VERSION_TLS_1_2 sslver->max = SSL_LIBRARY_VERSION_TLS_1_2; #elif defined SSL_LIBRARY_VERSION_TLS_1_1 |