Using SSL_CTX_set_options to disallow specific versions is discouraged by the documentation, which recommends to use SSL_CTX_set_min_proto_version instead.
Unified · Split
| @@ -899,7 +899,11 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op · 898 unmodified lines | |||
| 899 | ret = AVERROR(EIO); | 899 | ret = AVERROR(EIO); |
| 900 | goto fail; | 900 | goto fail; |
| 901 | } | 901 | } |
| 902 | SSL_CTX_set_options(p->ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); | 902 | if (!SSL_CTX_set_min_proto_version(p->ctx, TLS1_VERSION)) { |
| 903 | av_log(h, AV_LOG_ERROR, "Failed to set minimum TLS version to TLSv1\n"); | ||
| 904 | ret = AVERROR_EXTERNAL; | ||
| 905 | goto fail; | ||
| 906 | } | ||
| 903 | ret = openssl_init_ca_key_cert(h); | 907 | ret = openssl_init_ca_key_cert(h); |
| 904 | if (ret < 0) goto fail; | 908 | if (ret < 0) goto fail; |
| 905 | // Note, this doesn't check that the peer certificate actually matches | 909 | // Note, this doesn't check that the peer certificate actually matches |