-
-
Notifications
You must be signed in to change notification settings - Fork 11.1k
Description
The OpenSSL 3 release deprecated TLSv1_2_server_method().
Correction: Just realised that it was already deprecated earlier, but didn't give me a compile error before 3. The question still stands though
Because FTP is such a botched protocol, secure FTPS implementations have to rely on TLS sessions for its data connection security.
Currently I have implemented this using TLS1.2 session IDs (tickets disabled), and afaik this has been the de facto way to implement it for a while now (clients expect it to work this way too). It's using SSL_SESSION_get_id and SSL_client_hello_get0_session_id.
Session resumption in TLS1.3 works differently and I'm not getting the same Session ID from the client when it opens FTP data connections.
Thus, the change from TLSv1_2_server_method() to TLS_server_method() is a breaking change, and the upgrade path isn't clear to me. Is there a reasonable way to fix this, or should I stay on TLS1.2 (perhaps indefinitely)?