Always set security level to 0 for openssl versions >= 1.1.0

In version 1.1.0 of OpenSSL, a security level was introduced that enforces specific settings for certificates etc.
This PR sets the security level to 0, to retain the functionality that
previous versions of openssl had, and preventing errors like:

140088222534656:error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak:../ssl/ssl_rsa.c:310

See https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_security_level.html for more information about security levels.

Signed-off-by: Elias Norberg <elias@aisle.se>
Signed-off-by: Daniel Lenski <dlenski@gmail.com>

diff --git a/openssl.c b/openssl.c
index ac0d919a34a4d93b070a98dd08c0b8fb1479af57..5f71139e709c8eb6b6cd43c8356be30d50095941 100644 (file)
--- a/openssl.c
+++ b/openssl.c
@@ -1698,6 +1698,17 @@ int openconnect_open_https(struct openconnect_info *vpninfo)
                SSL_CTX_set_options(vpninfo->https_ctx, SSL_OP_NO_TICKET);
 #endif
 
+#if OPENSSL_VERSION_NUMBER >= 0x010100000L
+               /* OpenSSL versions after 1.1.0 added the notion of a "security level"
+                * that enforces checks on certificates and ciphers.
+                * These security levels overlap in functionality with the ciphersuite
+                * priority/allow-strings.
+                *
+                * For now we will set the security level to 0, thus reverting
+                * to the functionality seen in versions before 1.1.0. */
+               SSL_CTX_set_security_level(vpninfo->https_ctx, 0);
+#endif
+
                if (vpninfo->cert) {
                        err = load_certificate(vpninfo);
                        if (!err && !SSL_CTX_check_private_key(vpninfo->https_ctx)) {