Blob Blame History Raw

https://bugzilla.redhat.com/show_bug.cgi?id=1618371 

--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslprotdefault
+++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
@@ -119,7 +119,7 @@
     mctx->ticket_key          = NULL;
 #endif
 
-    mctx->protocol            = SSL_PROTOCOL_DEFAULT;
+    mctx->protocol            = SSL_PROTOCOL_NONE;
     mctx->protocol_set        = 0;
 
     mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
--- httpd-2.4.34/modules/ssl/ssl_engine_init.c.sslprotdefault
+++ httpd-2.4.34/modules/ssl/ssl_engine_init.c
@@ -555,9 +555,8 @@
      *  Create the new per-server SSL context
      */
     if (protocol == SSL_PROTOCOL_NONE) {
-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
-                "No SSL protocols available [hint: SSLProtocol]");
-        return ssl_die(s);
+        ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, 
+                     "Using OpenSSL/system default SSL/TLS protocols");
     }
 
     cp = apr_pstrcat(p,
@@ -673,14 +672,8 @@
     } else if (protocol & SSL_PROTOCOL_SSLV3) {
         prot = SSL3_VERSION;
 #endif
-    } else {
-        SSL_CTX_free(ctx);
-        mctx->ssl_ctx = NULL;
-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
-                "No SSL protocols available [hint: SSLProtocol]");
-        return ssl_die(s);
     }
-    SSL_CTX_set_max_proto_version(ctx, prot);
+    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot);
 
     /* Next we scan for the minimal protocol version we should provide,
      * but we do not allow holes between max and min */
@@ -700,7 +693,7 @@
         prot = SSL3_VERSION;
     }
 #endif
-    SSL_CTX_set_min_proto_version(ctx, prot);
+    if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot);
 #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */
 
 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE