Change ssl version with Net::HTTP and Ruby 1.8.7 -
One of my heritage Ruby apps still uses Ruby 1.8.7 It makes many HTTP requests to third party web services and some of them are on SSL.
Those third-party services are leaving SSLV3 as a PLL vulnerability and I want to patch my client to continue connecting with them.
There is no way to change the SSL version used in Ruby's standard library net :: HTTP
.
There is a way to change the version in Ruby's openssl
(). Unfortunately, this is not appearing by net :: HTTP
().
Do we (Ruby users 1.8.7) are bad?
Edit : It seems that the customer is switching to TLSv1
if the server does not support SSLv3
. I have an SSL enabled website behind the NSCX, which is without SSLV3 support, and I have verified that my 1.8.7 client is switching to TLSV1 and the request works if you want to verify yourself Here are a look at:
In fact, it seems that the customer is TLSV1 Switching on if the server does not support SSLv3
this In other ways, the client server inside the SSL handshake reveals what it can do (protocol, ciphers) and the server also raises it at best. Generally the client is default only for SSLv23, which does not limit the customer to specific protocols. If the server offers TLSV1 then they will continue with it, if the server only provides SSLv3, then they will use SSL 3.0.
If you want to restrict the client to the best, but do not allow SSL 3.0 to disable SSLv3 by setting SSl_options.
Comments
Post a Comment