On 07/04/2015 17:09, David Rueter wrote:
You're confusing SSLv3 the protocol, with SSLv3 ciphersuites.
Yes, I admit I am not distinguishing between these. However, !SSLv3 in the
cipher list does evidently disable the SSLv3 protocol as well--as evidenced
by testing with https://www.ssllabs.com/ssltest
Since I don't have source for the application I can only control OpenSSL's
behavior through the cypher list. I guess I will have to choose between
leaving SSLv3 enabled and breaking Android and IE on XP users (that require
TLSv1).
Is OpenSSL in its own DLL/DLLs? If so, could you simply
recompile OpenSSL (at latestpatchlevel) without the SSL3
protocol?
This would also provide all the other security fixes that
have been added to OpenSSL since someone gave you the
program.
Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
