Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ssl_security_level support #752

Merged
merged 1 commit into from Jun 28, 2021

Conversation

rwg-stripe
Copy link
Contributor

This change adds an :ssl_security_level option to change the security level of the SSLContext before Excon uses it to create an SSLSocket.

OpenSSL 1.1.0 introduced security levels, where increasingly large security levels forbid increasingly strong cryptographic algorithms and parameters. Security level 0 forbids nothing (the default behavior in previous versions of OpenSSL), and security level 5 allows only very strong algorithms and very long key lengths.

Every OpenSSL library now has a default security level compiled into it, and programs may need to change the security level from its default.

Changing an OpenSSL::SSL::SSLContext's security level requires Ruby 2.4.0+ or version 2.0.0+ of the openssl gem. See the following for more information:

This change adds an :ssl_security_level option to change the security
level of the SSLContext before Excon uses it to create an SSLSocket.

OpenSSL 1.1.0 introduced security levels, where increasingly large
security levels forbid increasingly strong cryptographic algorithms and
parameters.  Security level 0 forbids nothing (the default behavior in
previous versions of OpenSSL), and security level 5 allows only very
strong algorithms and very long key lengths.

Every OpenSSL library now has a default security level compiled into it,
and programs may need to change the security level from its default.

Changing an OpenSSL::SSL::SSLContext's security level requires Ruby
2.4.0+ or version 2.0.0+ of the openssl gem. See the following for more
information:

- https://ruby-doc.org/stdlib-2.4.0/libdoc/openssl/rdoc/OpenSSL/SSL/SSLContext.html#method-i-security_level-3D
- https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set_security_level.html
Copy link
Contributor

@geemus geemus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks for the detailed report and patch!

@geemus geemus merged commit a63db0f into excon:master Jun 28, 2021
@geemus
Copy link
Contributor

geemus commented Jun 28, 2021

Released in v0.83.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants