Mirrors_Framework/mosquitto
1
0
Fork 0
mirror of https://github.com/eclipse-mosquitto/mosquitto.git synced 2026-08-18 01:48:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

Re-enable support for TLS 1.1 in the broker but not by default

Browse Source 
Log a scary message if used.
This commit is contained in:
Roger A. Light
2026-01-28 00:40:24 +00:00
parent 79c6cb997b
commit ebd3f228e0
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog.txt
+2 -1
View File
@@ -45,7 +45,8 @@
certificate to be considered valid.
- Add `bridge_tls_use_os_certs` option to allow bridges to be easily configured
to trust default CA certificates. Closes #2473.
- Remove support for TLS v1.1.
- Remove support for TLS v1.1 (clients only - it remains available in the
broker but is now undocumented)
- Use openssl provided function for x509 certificate hostname verification,
rather than own function.
src/net.c
+9
View File
@@ -446,6 +446,15 @@ int net__tls_server_ctx(struct mosquitto__listener *listener)
#endif
}else if(!strcmp(listener->tls_version, "tlsv1.2")){
SSL_CTX_set_options(listener->ssl_ctx, SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);
}else if(!strcmp(listener->tls_version, "tlsv1.1")){
SSL_CTX_set_options(listener->ssl_ctx, SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1);
log__printf(NULL, MOSQ_LOG_WARNING, "Warning: TLS v1.1 is insecure. It must only be used in the case "
"where you have devices that cannot be upgraded to use a secure version of TLS. It is "
"recommended to use as secure a set of ciphers as possible and that will restrict it to "
"TLS v1.1 only, and to use a separate listener using TLS v1.2 and secure ciphers for your "
"other devices.");
log__printf(NULL, MOSQ_LOG_WARNING, "Please be aware that support for TLS v1.1 will go away eventually "
"and that you should plan now to migrate away from it.");
}else{
log__printf(NULL, MOSQ_LOG_ERR, "Error: Unsupported tls_version \"%s\".", listener->tls_version);
return MOSQ_ERR_TLS;