Re: [TLS] Working Group Last Call for draft-ietf-tls-sslv3-diediedie-00

[Kurt Roeckx <[e-mail]>]

On Thu, Jan 29, 2015 at 11:18:44AM +0100, Hubert Kario wrote:
> > For
> > some reason 1.2 actually seems to better support than 1.1.  There
> > are a strange set of servers out there that support 1.0 and 1.2
> > but not 1.1.
> 
> bug in openssl, SSL_OP_ALL from OpenSSL 1.0.0 did include SSL_OP_NO_TLSv1_1 
> when run against OpenSSL 1.0.1:
> https://rt.openssl.org/Ticket/Display.html?id=2802&user=guest&pass=guest
> 
> which you should know, given that you have submitted the above bug report ;)

I do know about that bug report.  The only people that should have
been affected by it were those that compiled against 1.0.1 and not
against ealier or later releases like any 1.0.0* or 1.0.1[a-l].

The sites that have this behaviour are also larger sites that
probably use some kind of accelator hardware, and I suspect it's
that hardware that doesn't do TLS 1.1.  At least 1 site I know
about that doesn't know TLS 1.1 but does TLS 1.2 is also
vulnerable to poodle in TLS, so they can't be using openssl.


Kurt