From 9f4c8267f9210e231a0ea61871af999bf42a1d71 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Fri, 15 Jun 2018 11:26:16 -0400
Subject: [PATCH] Don't set maximum TLS version unless it is <max. Support TLS
 1.3.

---
 cups/tls-darwin.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/cups/tls-darwin.c b/cups/tls-darwin.c
index 3e3a95daa8..e8c448081d 100644
--- a/cups/tls-darwin.c
+++ b/cups/tls-darwin.c
@@ -1283,14 +1283,16 @@ _httpTLSStart(http_t *http)		/* I - HTTP connection */
       kTLSProtocol1,
       kTLSProtocol11,
       kTLSProtocol12,
-      kTLSProtocol12, /* TODO: update to 1.3 when 1.3 is supported */
-      kTLSProtocol12  /* TODO: update to 1.3 when 1.3 is supported */
+      kTLSProtocol13
     };
 
-    error = SSLSetProtocolVersionMin(http->tls, protocols[tls_min_version]);
-    DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", protocols[tls_min_version], (int)error));
+    if (tls_min_version < _HTTP_TLS_MAX)
+    {
+      error = SSLSetProtocolVersionMin(http->tls, protocols[tls_min_version]);
+      DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", protocols[tls_min_version], (int)error));
+    }
 
-    if (!error)
+    if (!error && tls_max_version < _HTTP_TLS_MAX)
     {
       error = SSLSetProtocolVersionMax(http->tls, protocols[tls_max_version]);
       DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMax(%d), error=%d", protocols[tls_max_version], (int)error));
-- 
2.47.2