Advisory: How to disable TLS1.0 and TLS1.1

[Longqin88888]

What should I do if I want to disable TLS 1.0 and TLS 1.0? Is there an interface to do it? I don't want TLS1.0 and TLS1.0 in the supported versions of the client and server, but I tried sslVersion set to MQTT_SSL_VERSION_TLS_1_2, TLS1.0 and TLS1.0 still exist in supported versions.

[jumoog]

Set the sslVersion on the Broker side

[Longqin88888]

Isn't there a way to do this on the client side?

[jumoog]

Yes, but you have to modify SSLSocket.c and set the minimum TLS version.

  SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);

[Longqin88888]

It is available after the modification according to your suggestion. if(opts->sslVersion) { if(opts->sslVersion == MQTT_SSL_VERSION_DEFAULT || opts->sslVersion == MQTT_SSL_VERSION_TLS_1_0) { SSL_CTX_set_min_proto_version(net->ctx, TLS1_VERSION); }else if(opts->sslVersion == MQTT_SSL_VERSION_TLS_1_1) { SSL_CTX_set_min_proto_version(net->ctx, TLS1_1_VERSION); } else if (opts->sslVersion == MQTT_SSL_VERSION_TLS_1_2) { SSL_CTX_set_min_proto_version(net->ctx, TLS1_2_VERSION); } }

[Longqin88888]

Is there any consideration to add this function? I see that when using openssl1.1.0 or below, the client can disable TLS1.0 and 1.1 by sslVersion, but if using openssl1.1.0 or above, this parameter is invalid on the client.

if (OPENSSL_VERSION_NUMBER >= 0x10100000L)

    net->ctx = SSL_CTX_new(TLS_client_method());

else

    int sslVersion = MQTT_SSL_VERSION_DEFAULT;
    if (opts->struct_version >= 1) sslVersion = opts->sslVersion;

/* SSL_OP_NO_TLSv1_1 is defined in ssl.h if the library version supports TLSv1.1.

• OPENSSL_NO_TLS1 is defined in opensslconf.h or on the compiler command line
• if TLS1.x was removed at OpenSSL library build time via Configure options. / switch (sslVersion) { case MQTT_SSL_VERSION_DEFAULT: net->ctx = SSL_CTX_new(SSLv23_client_method()); / SSLv23 for compatibility with SSLv2, SSLv3 and TLSv1 */ break;

  if defined(SSL_OP_NO_TLSv1) && !defined(OPENSSL_NO_TLS1)

  case MQTT_SSL_VERSION_TLS_1_0:
      net->ctx = SSL_CTX_new(TLSv1_client_method());
      break;

  endif

  if defined(SSL_OP_NO_TLSv1_1) && !defined(OPENSSL_NO_TLS1)

  case MQTT_SSL_VERSION_TLS_1_1:
      net->ctx = SSL_CTX_new(TLSv1_1_client_method());
      break;

  endif

  if defined(SSL_OP_NO_TLSv1_2) && !defined(OPENSSL_NO_TLS1)

  case MQTT_SSL_VERSION_TLS_1_2:
      net->ctx = SSL_CTX_new(TLSv1_2_client_method());
      break;

  endif

  default:
      break;
  }