On Sat, Mar 17, 2012 at 3:53 PM, Stephen Henson via RT <r...@openssl.org>wrote:
> > My reading of RFC4492 is that the ECC ciphersuites apply only to TLS > > 1.0 or later. According to it: "This document describes additions to TLS > > to support ECC, applicable both to TLS Version 1.0 [2] and to TLS > > Version 1.1 [3]. In particular, it defines...". > Well, SSL 3.0 was never passed as an IETF spefication, so if SSL 3.0 is the common protocol version, everything's an ad hoc interpretation of the RFCs (or, worse, you're really following draft-freier-ssl-version3-01.txt by the letter). SSL 3.0 behavior is just out of the scope of the RFCs; there's not good reason not to use the ECC ciphersuites in SSL 3.0 (apart from the various good reasons to entirely avoid SSL 3.0). > $ ./gnutls-cli localhost -p 5556 --x509cafile > ../doc/credentials/x509/ca.pem -d 99 > ... > |<3>| HSK[0x1d0bdc0]: Server's version: 3.0 Does this indicate that the server was actually configured to to only support SSL 3.0, not TLS? Bodo
