tree 36015864bdb27af10e2363d1c5c7b3705ee7f16a
parent 13aa27338663c62600249ece54c94f180d57bbb7
author David Benjamin <davidben@google.com> 1715794110 -0400
committer David Benjamin <davidben@google.com> 1716586298 +0000

Set the minumum TLS version to (D)TLS 1.2 by default

Update-Note: By default, BoringSSL will now disable (D)TLS 1.0 and 1.1,
aligning with RFC 8996 and the behavior of modern browsers. Callers
which leave the minimum version at the default will now change to a
higher minimum version.

Callers which use SSL_CTX_set_proto_version and SSL_set_proto_version
are not affected. If this breaks something and the application needed
the legacy versions after all, call one of those functions with
TLS1_VERSION (or DTLS1_VERSION for DTLS) to restore the old behavior.

Bug: 599
Change-Id: Ic6e2d7a2ac7c190e81bd715b736c20e942f580b5
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/68487
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Bob Beck <bbe@google.com>
Reviewed-by: Bob Beck <bbe@google.com>