From 59008a464d20c32eaf7982c02e375b0d5c2be928 Mon Sep 17 00:00:00 2001 From: Anthony Hu Date: Wed, 19 Aug 2026 20:12:27 -0400 Subject: [PATCH 1/2] Warn about non-conformance when using old TLS versions. --- wolfSSL/src/chapter02.md | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/wolfSSL/src/chapter02.md b/wolfSSL/src/chapter02.md index 3aacf33a..99fda8c3 100644 --- a/wolfSSL/src/chapter02.md +++ b/wolfSSL/src/chapter02.md @@ -1049,7 +1049,11 @@ Removes support for ASN formatted certificate processing. #### NO_OLD_TLS -Removes support for SSLv3, TLSv1.0 and TLSv1.1 +Removes support for SSLv3, TLSv1.0 and TLSv1.1. This macro is defined by +default; it is only left undefined when old TLS support is explicitly requested +(for example with `--enable-oldtls`, `--enable-tlsv10` or `--enable-sslv3`). + +**Warning:** Leaving `NO_OLD_TLS` undefined produces a build that is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. RFC 8996 deprecates TLS 1.0 and TLS 1.1, and RFC 9846 states that SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 "MUST NOT be negotiated for any reason". Only build without `NO_OLD_TLS` when legacy interoperability requires it, and do not claim conformance with those RFCs for such a build. #### WOLFSSL_AEAD_ONLY @@ -1133,7 +1137,15 @@ Rejects DTLS records that have a future epoch number. Provides stricter epoch va #### WOLFSSL_ALLOW_TLSV10 -Allows TLS 1.0 connections. TLS 1.0 is disabled by default for security reasons. Only enable when legacy compatibility is required. +Allows TLS 1.0 connections. TLS 1.0 is disabled by default for security reasons. Only enable when legacy compatibility is required. Implies that `NO_OLD_TLS` is not defined. + +**Warning:** Defining `WOLFSSL_ALLOW_TLSV10` produces a build that is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. TLS 1.0 is deprecated by RFC 8996, and RFC 9846 states it "MUST NOT be negotiated for any reason". + +#### WOLFSSL_ALLOW_SSLV3 + +Allows SSL 3.0 connections. SSL 3.0 is disabled by default for security reasons. Only enable when legacy compatibility is required. Implies that `NO_OLD_TLS` is not defined. + +**Warning:** Defining `WOLFSSL_ALLOW_SSLV3` produces a build that is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. SSL 3.0 is deprecated by RFC 7568 and RFC 8996, and RFC 9846 states it "MUST NOT be negotiated for any reason". #### WOLFSSL_ALLOW_TLS_SHA1 @@ -4308,11 +4320,22 @@ Disable the error strings table ### `--disable-oldtls` -Disable old TLS version < 1.2 +Disable old TLS version < 1.2. This is the default; the corresponding +`--enable-oldtls` leaves `NO_OLD_TLS` undefined. + +**Warning:** Building with `--enable-oldtls` is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. RFC 8996 deprecates TLS 1.0 and TLS 1.1, and RFC 9846 states that SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 "MUST NOT be negotiated for any reason". + +### `--enable-tlsv10` + +Enable TLS version 1.0 (defines `WOLFSSL_ALLOW_TLSV10`, and enables old TLS). + +**Warning:** Building with `--enable-tlsv10` is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. See `--disable-oldtls` above. ### `--enable-sslv3` -Enable SSL version 3.0 +Enable SSL version 3.0 (defines `WOLFSSL_ALLOW_SSLV3`, and enables old TLS). + +**Warning:** Building with `--enable-sslv3` is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. SSL 3.0 is deprecated by RFC 7568 and RFC 8996, and RFC 9846 states it "MUST NOT be negotiated for any reason". ### `--enable-stacksize` From 65e4af134c704b51491d6a27a3f5862cc19e97ec Mon Sep 17 00:00:00 2001 From: Anthony Hu Date: Tue, 15 Sep 2026 15:58:49 -0400 Subject: [PATCH 2/2] reference correct RFC 7568 only --- wolfSSL/src/chapter02.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/wolfSSL/src/chapter02.md b/wolfSSL/src/chapter02.md index 99fda8c3..16473416 100644 --- a/wolfSSL/src/chapter02.md +++ b/wolfSSL/src/chapter02.md @@ -1145,7 +1145,7 @@ Allows TLS 1.0 connections. TLS 1.0 is disabled by default for security reasons. Allows SSL 3.0 connections. SSL 3.0 is disabled by default for security reasons. Only enable when legacy compatibility is required. Implies that `NO_OLD_TLS` is not defined. -**Warning:** Defining `WOLFSSL_ALLOW_SSLV3` produces a build that is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. SSL 3.0 is deprecated by RFC 7568 and RFC 8996, and RFC 9846 states it "MUST NOT be negotiated for any reason". +**Warning:** Building with `--enable-sslv3` violates RFC 7568. SSL 3.0 is deprecated by RFC 7568 and states "SSLv3 MUST NOT be used." #### WOLFSSL_ALLOW_TLS_SHA1 @@ -4335,7 +4335,7 @@ Enable TLS version 1.0 (defines `WOLFSSL_ALLOW_TLSV10`, and enables old TLS). Enable SSL version 3.0 (defines `WOLFSSL_ALLOW_SSLV3`, and enables old TLS). -**Warning:** Building with `--enable-sslv3` is **not conformant** with RFC 9846, RFC 8996 or RFC 9325. SSL 3.0 is deprecated by RFC 7568 and RFC 8996, and RFC 9846 states it "MUST NOT be negotiated for any reason". +**Warning:** Building with `--enable-sslv3` violates RFC 7568. SSL 3.0 is deprecated by RFC 7568 and states "SSLv3 MUST NOT be used." ### `--enable-stacksize`