module OpenSSL
Changes made by openssl/better_defaults¶ ↑
Miscellaneous resources¶ ↑
Rationale for disabling features¶ ↑
Reason | Disabled features | Notes ============================================================================== | SSL 2.0 | https://tools.ietf.org/html/rfc6176 BEST, LUCKY13 | SSL 3.0 Ciphers using CBC mode | POODLE | SSL 3.0 | RC4 weaknesses | All RC4-based ciphers | CRIME | TLS Compression | http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/
Note on CRIME/BREACH¶ ↑
Disabling TLS compression avoids CRIME at the TLS level. However, both CRIME and BREACH can be used against HTTP compression– which is entirely out of the scope of this library.
See also, en.wikipedia.org/wiki/CRIME
Note on SSL/TLS versions¶ ↑
Instead of being able to specify a minimum SSL
version, OpenSSL
only lets you either enable an individual version, or enable everything.
Individual options for disabling SSL
2.0 and SSL
3.0 are also available.
Thus, to enable TLS 1.0+ only, you have to: