starred/certbot-certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-08-01 10:51:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

Use updated name TLS_METHOD instead of SSLv23_METHOD (#10237)

Browse Source 
Fixes #10231
This commit is contained in:
ohemorange
2025-03-14 10:38:02 -07:00
committed by GitHub
parent df9075e023
commit 7322e56cc7
2 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
acme/acme/crypto_util.py
+4 -5
View File
@@ -32,12 +32,12 @@ logger = logging.getLogger(__name__)
# Default SSL method selected here is the most compatible, while secure # Default SSL method selected here is the most compatible, while secure
# SSL method: TLSv1_METHOD is only compatible with # SSL method: TLSv1_METHOD is only compatible with
# TLSv1_METHOD, while SSLv23_METHOD is compatible with all other # TLSv1_METHOD, while TLS_method is compatible with all other
# methods, including TLSv2_METHOD (read more at # methods, including TLSv2_METHOD (read more at
# https://www.openssl.org/docs/ssl/SSLv23_method.html). _serve_sni # https://docs.openssl.org/master/man3/SSL_CTX_new/#notes). _serve_sni
# should be changed to use "set_options" to disable SSLv2 and SSLv3, # should be changed to use "set_options" to disable SSLv2 and SSLv3,
# in case it's used for things other than probing/serving! # in case it's used for things other than probing/serving!
_DEFAULT_SSL_METHOD = SSL.SSLv23_METHOD _DEFAULT_SSL_METHOD = SSL.TLS_METHOD
class Format(enum.IntEnum): class Format(enum.IntEnum):
@@ -133,8 +133,7 @@ class SSLSocket: # pylint: disable=too-few-public-methods
return return
key, cert = pair key, cert = pair
new_context = SSL.Context(self.method) new_context = SSL.Context(self.method)
new_context.set_options(SSL.OP_NO_SSLv2) new_context.set_min_proto_version(SSL.TLS1_2_VERSION)
new_context.set_options(SSL.OP_NO_SSLv3)
new_context.use_privatekey(key) new_context.use_privatekey(key)
new_context.use_certificate(cert) new_context.use_certificate(cert)
if self.alpn_selection is not None: if self.alpn_selection is not None:
certbot/certbot/crypto_util.py
+1 -1
View File
@@ -351,7 +351,7 @@ def verify_cert_matches_priv_key(cert_path: str, key_path: str) -> None:
:raises errors.Error: If they don't match. :raises errors.Error: If they don't match.
""" """
try: try:
context = SSL.Context(SSL.SSLv23_METHOD) context = SSL.Context(SSL.TLS_METHOD)
context.use_certificate_file(cert_path) context.use_certificate_file(cert_path)
context.use_privatekey_file(key_path) context.use_privatekey_file(key_path)
context.check_privatekey() context.check_privatekey()