Okay, I'll do my best asking this.
Okay, I'll do my best asking this.
We use Indy for all our TCP needs.
We have a number of servers that use SSL/TLS. We recently moved everything to TLS v1.2.
I've been tasked with allowing the graceful "downgrading" of TLS from 1.2 to 1.1 and/or 1.0 if the end user allows it.
I've done this by including or excluding values in the TIdSSLOptions.SSLVersions property. My assumption (you know what that means....) has been that the values in that set are the SSL/TLS types that Indy will accept, and will reject attempts to connect at levels not found in that property.
Am I right in my assumption?
I ask this because it appears that I am not -- can can't seem to get a server to reject a TLS v1.0 request when sslvTLSv1 is not in the SSLVersions property.
Am I making any sense? This is a new area for me, so any help would be gratefully accepted.
We use Indy for all our TCP needs.
We have a number of servers that use SSL/TLS. We recently moved everything to TLS v1.2.
I've been tasked with allowing the graceful "downgrading" of TLS from 1.2 to 1.1 and/or 1.0 if the end user allows it.
I've done this by including or excluding values in the TIdSSLOptions.SSLVersions property. My assumption (you know what that means....) has been that the values in that set are the SSL/TLS types that Indy will accept, and will reject attempts to connect at levels not found in that property.
Am I right in my assumption?
I ask this because it appears that I am not -- can can't seem to get a server to reject a TLS v1.0 request when sslvTLSv1 is not in the SSLVersions property.
Am I making any sense? This is a new area for me, so any help would be gratefully accepted.
Your assumption should in theory work, however, in practice you might need additional tweaking... which version of Indy/OpenSSL libs are you using?
ReplyDeleteOndrej Kelle Thanks for the answer.
ReplyDeleteOur Indy is 10.6.2.0
Our Libeay32.dll is version 1.0.1.18
Nick
Hey Nick, no problem! :-) I'm afk atm but later when I get to my machine I'll have a look. Unless you've already got your solution from Remy Lebeau by that time. :-)
ReplyDelete/sub
ReplyDeleteIf you have a github or twitter account, or are willing to sign up for one, Remy is pretty responsive here:
ReplyDeletehttps://gitter.im/IndySockets/Indy
Can't emphasise enough how much value Remy is to Indy; he's a Saint
/sub
ReplyDelete/sub
ReplyDelete/sub
ReplyDeleteI've just tried and it works as expected: if I use [sslvTLSv1_1,sslvTLSv1_2] then TLS 1.0 is rejected, only 1.1 or 1.2 is accepted. I'm using Indy trunk and OpenSSL 1.0.2h.
ReplyDeleteOndrej Kelle Here's a key question: How did you tell? ;-)
ReplyDeleteThanks again.
Nick Hodges I've used the Indy HTTP Server demo I've downloaded somewhere, and I've used Firefox about:config to switch TLS versions and page info to see the connection properties.
ReplyDeleteOkay, thanks very much again.
ReplyDeleteNick Hodges Welcome :-)
ReplyDeleteAs a follow up, it took a bit of debugging, but the reason I wasn't seeing TLS v1.1 or TLSv1.2 connections was that my app was loading up an very old version of ssleay32.dll. Once I had it load the latest version, it worked fine.
ReplyDeleteThanks for all the help.