Feature Request: Support for TLS 1.2

[Thom Nichols]

When building against OpenSSL 1.0.1, it should be possible to take advantage of TLS 1.2 support. I believe this would require the addition of a OpenSSL.SSL.TLSv1_2_METHOD to signal the use of a TLS 1.2 handshake.

Also there is no TLS 1.1 method but it's unclear if that's covered by the OpenSSL.SSL.TLSv1_METHOD. There should be an explicit method for TLS v1.1 as well. Thanks!

[Fedor Brunner (fedor-brunner)]

This patch will add support for TLS v1.1 and TLS v1.2 . These protocols protect against SSL/TLS new attacks
https://en.wikipedia.org/wiki/Transport_Layer_Security#RC4_attacks
https://en.wikipedia.org/wiki/Transport_Layer_Security#CRIME_and_BREACH_attacks

[Jean-Paul Calderone (exarkun)]

This patch looks reasonable. However, please contribute future patches against *trunk* so that they don't need to be ported to trunk.

[Andy Lutomirski (luto-mit)]

After staring at the utter crap OpenSSL docs for a while, it turns out that, almost regardless of what you're trying to interoperate with, the correct method to use is SSL.SSLv23_METHOD. TLSv1_2_METHOD means TLS 1.2 *only*. Similarly, TLSv1_METHOD means TLS 1.0 *only* (in particular, TLSv1_METHOD disallows TLSv1.2).

If you use SSL.SSLv23_METHOD and set SSL.OP_NO_SSLv2 (and optionally SSL.OP_NO_SSLv3) then you get reasonable results, including the availability of GCM ciphers.

[Thom Nichols (tmnichols)]

FWIW, our use case requires enforcing TLS v.1.2 ONLY. However good to know how you would achieve support for any TLS 1.x versions.