From c01675d34288018e46d8b92aacacac4151a85d8f Mon Sep 17 00:00:00 2001 From: Tatsuya Kinoshita Date: Wed, 10 Feb 2021 19:20:37 +0900 Subject: New option ssl_cipher to specify ciphers for TLSv1.2 and below --- url.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'url.c') diff --git a/url.c b/url.c index 5cb171d..c7eeb16 100644 --- a/url.c +++ b/url.c @@ -336,9 +336,11 @@ openSSLHandle(int sock, char *hostname, char **p_cert) #endif if (!(ssl_ctx = SSL_CTX_new(SSLv23_client_method()))) goto eend; -#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER) - SSL_CTX_set_cipher_list(ssl_ctx, "DEFAULT:!LOW:!RC4:!EXP"); -#endif + if (ssl_cipher && *ssl_cipher != '\0') + if (!SSL_CTX_set_cipher_list(ssl_ctx, ssl_cipher)) { + free_ssl_ctx(); + goto eend; + } option = SSL_OP_ALL; if (ssl_forbid_method) { if (strchr(ssl_forbid_method, '2')) -- cgit v1.2.3