Any browser (Firefox, Chrome, Opera) that can run Verto can do TLS1.2, We shouldn...

diff --git a/src/mod/endpoints/mod_verto/mod_verto.c b/src/mod/endpoints/mod_verto/mod_verto.c
index a5897fbbb685825c6050d23d000fca36d43b0cf6..1b3d48f2dd2d6c3fed09305831e4cdd1bd992a15 100644 (file)
--- a/src/mod/endpoints/mod_verto/mod_verto.c
+++ b/src/mod/endpoints/mod_verto/mod_verto.c
@@ -150,6 +150,17 @@ static void verto_init_ssl(verto_profile_t *profile)
        profile->ssl_ready = 1;
        assert(profile->ssl_ctx);
 
+       /* Disable SSLv2 */
+       SSL_CTX_set_options(profile->ssl_ctx, SSL_OP_NO_SSLv2);
+       /* Disable SSLv3 */
+       SSL_CTX_set_options(profile->ssl_ctx, SSL_OP_NO_SSLv3);
+       /* Disable TLSv1 */
+       SSL_CTX_set_options(profile->ssl_ctx, SSL_OP_NO_TLSv1);
+       /* Disable TLSv1_1 */
+       SSL_CTX_set_options(profile->ssl_ctx, SSL_OP_NO_TLSv1_1);
+       /* Disable Compression CRIME (Compression Ratio Info-leak Made Easy) */
+       SSL_CTX_set_options(profile->ssl_ctx, SSL_OP_NO_COMPRESSION);
+
        /* set the local certificate from CertFile */
        if (!zstr(profile->chain)) {
                SSL_CTX_use_certificate_chain_file(profile->ssl_ctx, profile->chain);

diff --git a/src/mod/endpoints/mod_verto/ws.c b/src/mod/endpoints/mod_verto/ws.c
index 3b152e4fec1eec0f35c978d268c420c253fbd2ef..e9100e297703aaf04981e78a8f0b76c5026d5ffd 100644 (file)
--- a/src/mod/endpoints/mod_verto/ws.c
+++ b/src/mod/endpoints/mod_verto/ws.c
@@ -92,10 +92,20 @@ void init_ssl(void) {
 
        OpenSSL_add_all_algorithms();   /* load & register cryptos */
        SSL_load_error_strings();     /* load all error messages */
-       ws_globals.ssl_method = TLSv1_server_method();   /* create server instance */
+       ws_globals.ssl_method = SSLv23_server_method();   /* create server instance */
        ws_globals.ssl_ctx = SSL_CTX_new(ws_globals.ssl_method);         /* create context */
        assert(ws_globals.ssl_ctx);
-       
+
+       /* Disable SSLv2 */
+       SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_SSLv2);
+       /* Disable SSLv3 */
+       SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_SSLv3);
+       /* Disable TLSv1 */
+       SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_TLSv1);
+       /* Disable TLSv1_1 */
+       SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_TLSv1_1);
+       /* Disable Compression CRIME (Compression Ratio Info-leak Made Easy) */
+       SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_COMPRESSION);
        /* set the local certificate from CertFile */
        SSL_CTX_use_certificate_file(ws_globals.ssl_ctx, ws_globals.cert, SSL_FILETYPE_PEM);
        /* set the private key from KeyFile */