openssl version bump #5116

1. 
   DomT4 commented at 8:50 PM on October 21, 2014: contributor

   Bumps the OpenSSL version to the latest release, and kills SSL2. (SSL3 was already killed here, so I'm not sure why SSL2 was left around..?)

   No other changes.

2. openssl version bump

   Bumps the OpenSSL version to the latest release, and kills SSL2. (SSL3 was already killed here, so I'm not sure why SSL2 was left around?)
   
   No other changes.

   a6a3f141b1
3. 
   theuni commented at 2:01 AM on October 22, 2014: member

   IIRC ssl2 was kept due to an odd quirk with qt4. But I agree this is the correct, setting that aside.

   When I get around to finalizing #4727 we may see the ssl2 problem again, and we can decide how to proceed from there.

   Assuming there's no reason to avoid updating, ACK.

4. 
   DomT4 commented at 2:13 AM on October 22, 2014: contributor

   The qt libraries are such a pain. I cross my fingers for a better solution than qt one day. But yes, It'd certainly be good to kill off ssl2 if possible, given it has been the equivalent of shouting your encrypted data out of the window at random passersby for the last decade or so, heh. I use a no-ssl2 OpenSSL on OS X, so feel free to shout if I can be of any use testing old errors and such.

   Let me know if it's easier for you here for me to remove the no-ssl2 element of this PR for now.

5. 
   theuni commented at 2:24 AM on October 22, 2014: member

   No, I think it's good to remove it here. I'd rather be reminded of exactly why it's needed in a future PR that causes the breakage, then we can address the exact issue.

6. 
   Diapolo commented at 6:36 AM on October 22, 2014: none

   While we are on here, can someone look at our ciphers for RPC SSL connections again and decide, if we need to also update them? I did that once, but don't want to create a pull now.

   The string is TLSv1.2+HIGH:TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH and it's used in the help message and in rpc code.

7. 
   laanwj commented at 8:02 AM on October 22, 2014: member

   utACK

   I know of no issue with Qt and requiring ssl2. Can you be more specific?

8. laanwj added the label Build system on Oct 22, 2014
9. laanwj added this to the milestone 0.10.0 on Oct 22, 2014
10. 
    DomT4 commented at 6:05 PM on October 23, 2014: contributor

    Is there anything else I need to do here to help?

11. 
    theuni commented at 6:07 PM on October 23, 2014: member

    @laanwj and I discussed this on IRC yesterday. The bug is similar to this one: http://qt-project.org/forums/viewthread/16596/

    I believe we've decided to do as discussed above, disabling ssl2 and addressing any problems as they arise.

12. 
    laanwj commented at 2:42 PM on October 24, 2014: member

    @Diapolo I don't know, what is even the syntax of that string? Would a !SSLv3 make sense?

13. laanwj merged this on Oct 24, 2014
14. laanwj closed this on Oct 24, 2014

    ---

15. laanwj referenced this in commit c47b9c7ba7 on Oct 24, 2014
16. DomT4 deleted the branch on Oct 24, 2014
17. MarcoFalke locked this on Sep 8, 2021

Milestone
0.10.0