[THRIFT-2258] Add TLS v1.1/1.2 support to TSSLSocket.cpp

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.9.1
• Fix Version/s: 0.9.2
• Component/s: C++ - Library
• Labels: c++ ssl thrift tls
• Assignee: Chris Stylianou
• Reporter: Chris Stylianou
• Created: 08/Nov/13 09:31
• Updated: 01/Apr/14 04:24
• Resolved: 01/Apr/14 03:56

Description

At the moment TSSLSocket.cpp hard-codes the SSL/TLS protocol to TLSv1.0, which does not allow any other protocols to be used instead (SSL v3, TLS v1.0, v1.1, v1.2, ignores SSLv2 as horribly insecure).

Could a method be provided on the TSSLSocketFactory to set the required protocol (like how there is already a cipher() function available), so that when SSL_CTX_new, it is called with the specified SSL/TLS protocol.

Sorry to label this as a bug, but being unable to select the highest availabe security protocol for communication is a bug in my eyes.

Issue Links

• is related to: THRIFT-2325 SSL test certificates