pythonopenssltls1.2configuration-files

How to configure 'TLS1.2 only' in OpenSSL 1.0.2 config file?


I would like to update the configuration of OpenSSL 1.0.2 (specifically 1.0.2k-fips as found on AWS's Amazon Linux 2 AMIs), so that any client using OpenSSL refuses TLSv1.1, TLSv1, or anything lower that is not TLSv1.2.

I have learned that for OpenSSL 1.1+ the OpenSSL config file (e.g., /etc/pki/tls/openssl.cnf on Amazon Linux 2, or /usr/lib/ssl/openssl.cnf on Debian derivatives, or whatever $OPENSSL_CONF points to), one can specify openssl_conf -> a section with ssl_conf -> a section with system_default -> a section with MinProtocol=TLSv1.2.

However, that ssl_conf syntax is unknown in OpenSSL 1.0.2k, and instead it tries to load libssl_conf.so which fails because that shared library does not exist.

So my question: Is it possible to configure OpenSSL 1.0.2 to fail if one tries to use TLSv1.1 or below? At least if the openssl binary tries, or any Python code that I don't control using the ssl module for Python 3.9 or lower?


Additional information: At least on Amazon Linux 2 with OpenSSL 1.0.2k-fips, using grep I cannot even find the string MinProtocol in any OpenSSL 1.0.2 related binary or shared library. (But it does occur in an OpenSSL 1.1.1s libssl.so.1.1 that is shipped with an agent I happened to have on that same AL2 system.)

So that confirms my suspicion that the answer to my question is: No, this is not possible.


Solution

  • For the record, as a self-answer (to replace an answer that was deleted for looking ChatGPT-generated): OpenSSL 1.0.2 does not support configuring allowed SSL/TLS protocol versions or cipher suites through its configuration file.

    Evidence:

    (As ChatGPT pointed out, there are various ways where a cooperating client can give OpenSSL such settings, e.g., via its API, via the openssl command line, or via Python's ssl default SSL context; but that was not the point of this question.)