Skip to content

Recommended migration path for FTPS using TLS1.2 Session IDs? #16576

@bplu4t2f

Description

@bplu4t2f

The OpenSSL 3 release deprecated TLSv1_2_server_method().

Correction: Just realised that it was already deprecated earlier, but didn't give me a compile error before 3. The question still stands though

Because FTP is such a botched protocol, secure FTPS implementations have to rely on TLS sessions for its data connection security.

Currently I have implemented this using TLS1.2 session IDs (tickets disabled), and afaik this has been the de facto way to implement it for a while now (clients expect it to work this way too). It's using SSL_SESSION_get_id and SSL_client_hello_get0_session_id.

Session resumption in TLS1.3 works differently and I'm not getting the same Session ID from the client when it opens FTP data connections.

Thus, the change from TLSv1_2_server_method() to TLS_server_method() is a breaking change, and the upgrade path isn't clear to me. Is there a reasonable way to fix this, or should I stay on TLS1.2 (perhaps indefinitely)?

Metadata

Metadata

Assignees

No one assigned

    Labels

    resolved: answeredThe issue contained a question which has been answeredtriaged: questionThe issue contains a question

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions