Question

I am coding an SSL server in C + OpenSSL. This is pretty straightforward, and there are lots of examples to follow.

However, I need to interoperate with a broad range of legacy clients, some of which are really old, and have a variety of bugs which prevent SSL negotiation from working. Reaching the users of these clients to have them upgrade is impractical at best.

SSL_CTX_set_options(ctx, SSL_OP_ALL);

......帮助,但还有一些客户可以建立特别后勤联系。

我可以采取哪些其他措施使开放式特别安全区尽可能相互操作?

(一个有问题的客户是“视窗”的Kermit95——2003年汇编成册,我认为安装名录中有校正。) 虽然凯尔米特95来源现已自由,但即便是维护者也不知道如何在视窗上建造它。

Answer 1

我知道,有一些事情提高了开放式特别安全局的互操作性。

Use "ALL" or maybe "ALL:EXPORT:LOW". I haven t checked if ALL really does mean ALL.
There is a compile-time option to re-enable EXPORT56 ciphers in openSSL. You will have to set TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES to 1 in ssl/tls1.h. By default they are disabled
Some binary distributions including RedHat s leave out any ciphers that have patent issues.
The experimental ciphers are likely to require a 512 bit RSA key. See sample code here: http://www.openssl.org/docs/ssl/SSL_CTX_set_tmp_rsa_callback.html

基本答案——编辑你自己的开放式特别生活!

友情链接