]> git.ipfire.org Git - thirdparty/openssl.git/commit
Advertise FFDHE groups also with TLS 1.2-only
authorViktor Dukhovni <openssl-users@dukhovni.org>
Tue, 16 Dec 2025 16:48:06 +0000 (03:48 +1100)
committerAlexandr Nedvedicky <sashan@openssl.org>
Thu, 5 Feb 2026 09:09:18 +0000 (10:09 +0100)
commite9e0480e5da9a374521e55aa2d5faeb1843dd313
tree862a897a68383db3bc3c94293d1fd2f9bad41163
parent2af8022aaf799b42e59e2ea3332b41e56a9b9c73
Advertise FFDHE groups also with TLS 1.2-only

When the TLS max version is TLS 1.2, include supported RFC7919 FFDHE
groups in the supported_groups extension, provided we support at least
one DHE key exchange ciphersuite.

Also skip the EC point formats extension when the minimum (D)TLS version
is greater than 1.2.  That extension is obsolete as of (D)TLS 1.3.

Finally, folded some extant long lines from the previous RFC7919 commits.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Feb  5 09:09:43 2026
(Merged from https://github.com/openssl/openssl/pull/24551)
15 files changed:
ssl/ssl_local.h
ssl/statem/extensions_clnt.c
ssl/statem/extensions_srvr.c
ssl/statem/statem_srvr.c
ssl/t1_lib.c
test/recipes/70-test_sslmessages.t
test/recipes/70-test_tls13kexmodes.t
test/recipes/70-test_tls13messages.t
test/recipes/75-test_quicapi_data/ssltraceref-zlib.txt
test/recipes/75-test_quicapi_data/ssltraceref.txt
test/recipes/80-test_ssl_old.t
test/recipes/90-test_sslapi_data/ssltraceref-zlib.txt
test/recipes/90-test_sslapi_data/ssltraceref.txt
test/ssl_old_test.c
test/sslapitest.c