On Thu, Dec 18, 2003 at 08:02:46AM +0100, Obermeier Markus ICM MP PD TS wrote:
> On Wed, Dec 17, 2003, Dr. Stephen Henson wrote:
>
> > IIRC the client hello reports the supported ciphersuites in order of preference
> > and the OpenSSL server code will
> > normally use the first one from that list that it supports. The actual
> > ciphersuites supported by the server may be
> > less than those OpenSSL supports because some require DH parameters and others a
> > DSA certificate.
>
> > It is possible to override the clients preference though and use a server
> > preferred ciphersuite.
>
> > You could try disabling some ciphersuites with the server cipher string to see if
> > others will work.
>
> Steve,
>
> thanks for your explanation. I am very familiar with the protocol itself and
> understand your proposal, but I am a newbie to the openssl/libssl area.
>
> Please can you give me some hint where I can change the parameters you were talking
> about since I have no idea.
man SSL_CTX_set_cipher_list
man SSL_CTX_set_options (see SSL_OP_CIPHER_SERVER_PREFERENCE)
Best regards,
Lutz
--
Lutz Jaenicke [EMAIL PROTECTED]
http://www.aet.TU-Cottbus.DE/personen/jaenicke/
BTU Cottbus, Allgemeine Elektrotechnik
Universitaetsplatz 3-4, D-03044 Cottbus
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
