Skip to content

Warn about non-conformance when using old TLS versions. #278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anhu wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Warn about non-conformance when using old TLS versions. #278

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 27 additions & 4 deletions wolfSSL/src/chapter02.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1049,7 +1049,11 @@ Removes support for ASN formatted certificate processing.

#### NO_OLD_TLS

Removes support for SSLv3, TLSv1.0 and TLSv1.1
Removes support for SSLv3, TLSv1.0 and TLSv1.1. This macro is defined by
default; it is only left undefined when old TLS support is explicitly requested
(for example with `--enable-oldtls`, `--enable-tlsv10` or `--enable-sslv3`).

**Warning:** Leaving `NO_OLD_TLS` undefined produces a build that is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. RFC 8996 deprecates TLS 1.0 and TLS 1.1, and RFC 9846 states that SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 "MUST NOT be negotiated for any reason". Only build without `NO_OLD_TLS` when legacy interoperability requires it, and do not claim conformance with those RFCs for such a build.

#### WOLFSSL_AEAD_ONLY

Expand Down Expand Up @@ -1133,7 +1137,15 @@ Rejects DTLS records that have a future epoch number. Provides stricter epoch va

#### WOLFSSL_ALLOW_TLSV10

Allows TLS 1.0 connections. TLS 1.0 is disabled by default for security reasons. Only enable when legacy compatibility is required.
Allows TLS 1.0 connections. TLS 1.0 is disabled by default for security reasons. Only enable when legacy compatibility is required. Implies that `NO_OLD_TLS` is not defined.

**Warning:** Defining `WOLFSSL_ALLOW_TLSV10` produces a build that is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. TLS 1.0 is deprecated by RFC 8996, and RFC 9846 states it "MUST NOT be negotiated for any reason".

#### WOLFSSL_ALLOW_SSLV3

Allows SSL 3.0 connections. SSL 3.0 is disabled by default for security reasons. Only enable when legacy compatibility is required. Implies that `NO_OLD_TLS` is not defined.

**Warning:** Defining `WOLFSSL_ALLOW_SSLV3` produces a build that is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. SSL 3.0 is deprecated by RFC 7568 and RFC 8996, and RFC 9846 states it "MUST NOT be negotiated for any reason".


#### WOLFSSL_ALLOW_TLS_SHA1
Expand Down Expand Up @@ -4308,11 +4320,22 @@ Disable the error strings table

### `--disable-oldtls`

Disable old TLS version < 1.2
Disable old TLS version < 1.2. This is the default; the corresponding
`--enable-oldtls` leaves `NO_OLD_TLS` undefined.

**Warning:** Building with `--enable-oldtls` is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. RFC 8996 deprecates TLS 1.0 and TLS 1.1, and RFC 9846 states that SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 "MUST NOT be negotiated for any reason".

### `--enable-tlsv10`

Enable TLS version 1.0 (defines `WOLFSSL_ALLOW_TLSV10`, and enables old TLS).

**Warning:** Building with `--enable-tlsv10` is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. See `--disable-oldtls` above.

### `--enable-sslv3`

Enable SSL version 3.0
Enable SSL version 3.0 (defines `WOLFSSL_ALLOW_SSLV3`, and enables old TLS).

**Warning:** Building with `--enable-sslv3` is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. SSL 3.0 is deprecated by RFC 7568 and RFC 8996, and RFC 9846 states it "MUST NOT be negotiated for any reason".

### `--enable-stacksize`

Expand Down
Loading