Commit 4864ee17 authored by Elias Norberg's avatar Elias Norberg Committed by Daniel Lenski

Always set security level to 0 for openssl versions >= 1.1.0

In version 1.1.0 of OpenSSL, a security level was introduced that enforces specific settings for certificates etc.
This PR sets the security level to 0, to retain the functionality that
previous versions of openssl had, and preventing errors like:

140088222534656:error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak:../ssl/ssl_rsa.c:310

See https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_security_level.html for more information about security levels.
Signed-off-by: default avatarElias Norberg <elias@aisle.se>
Signed-off-by: default avatarDaniel Lenski <dlenski@gmail.com>
parent 14a1c56a
......@@ -1698,6 +1698,17 @@ int openconnect_open_https(struct openconnect_info *vpninfo)
SSL_CTX_set_options(vpninfo->https_ctx, SSL_OP_NO_TICKET);
#endif
#if OPENSSL_VERSION_NUMBER >= 0x010100000L
/* OpenSSL versions after 1.1.0 added the notion of a "security level"
* that enforces checks on certificates and ciphers.
* These security levels overlap in functionality with the ciphersuite
* priority/allow-strings.
*
* For now we will set the security level to 0, thus reverting
* to the functionality seen in versions before 1.1.0. */
SSL_CTX_set_security_level(vpninfo->https_ctx, 0);
#endif
if (vpninfo->cert) {
err = load_certificate(vpninfo);
if (!err && !SSL_CTX_check_private_key(vpninfo->https_ctx)) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment