Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove SSLv3 #1383

Merged
merged 2 commits into from
Mar 4, 2016
Merged

Remove SSLv3 #1383

merged 2 commits into from
Mar 4, 2016

Conversation

ghoneycutt
Copy link
Contributor

No description provided.

@hunner
Copy link
Contributor

hunner commented Mar 3, 2016

@igalic So, this sounds nice; do you think this would be "backwards incompatible change" or "security bugfix" or what?

@roidelapluie
Copy link
Contributor

Security Bugfix. POODLE.

@roidelapluie
Copy link
Contributor

However we could give people to ability to re-add the sslv3 in libnss with a parameter?

hunner added a commit that referenced this pull request Mar 4, 2016
@hunner
Merge pull request #1383 from ghoneycutt/remove_SSLv3
8552994 
Remove SSLv3
@hunner hunner merged commit 8552994 into puppetlabs:master Mar 4, 2016
@igalic
Copy link
Contributor

igalic commented Mar 8, 2016

pretty sure we've deprecated sslv3 a couple of years ago: https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslprotocol

@ghoneycutt
Copy link
Contributor Author

Thanks!

@ghoneycutt ghoneycutt deleted the remove_SSLv3 branch March 9, 2016 17:06
@hunner
Copy link
Contributor

hunner commented Mar 9, 2016

RFC-7525 would not even allow SSLv3 as a fallback, so yeah not allowing this to be turned on is a good idea.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
feature
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@ghoneycutt @hunner @roidelapluie @igalic @GSPatton