From 85eb8218f0e89eef9b9c16b71c190add7a55363d Mon Sep 17 00:00:00 2001 From: reverse Date: Mon, 24 Aug 2026 20:38:58 +0000 Subject: [PATCH] tls: openssl backend offers TLS 1.3 via mozilla_intermediate_v5 (was capped at 1.2) --- src/tls.rs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/tls.rs b/src/tls.rs index 7c0ae1f..31cb4c6 100644 --- a/src/tls.rs +++ b/src/tls.rs @@ -115,7 +115,8 @@ fn configure(b: &mut SslAcceptorBuilder, cert: &str, key: &str) -> io::Result<() /// A standalone configured context for one SNI hostname. fn build_ctx(cert: &str, key: &str) -> io::Result { - let mut b = SslAcceptor::mozilla_intermediate(SslMethod::tls()).map_err(err)?; + // _v5 = Mozilla intermediate v5 (TLS 1.2 + 1.3); the non-v5 profile caps at 1.2. + let mut b = SslAcceptor::mozilla_intermediate_v5(SslMethod::tls()).map_err(err)?; configure(&mut b, cert, key)?; Ok(b.build().into_context()) } @@ -127,7 +128,7 @@ fn build_acceptor(primary: &CertPaths, sni: &[(String, CertPaths)]) -> io::Resul for (host, cp) in sni { map.insert(host.to_ascii_lowercase(), build_ctx(&cp.cert, &cp.key)?); } - let mut b = SslAcceptor::mozilla_intermediate(SslMethod::tls()).map_err(err)?; + let mut b = SslAcceptor::mozilla_intermediate_v5(SslMethod::tls()).map_err(err)?; configure(&mut b, &primary.cert, &primary.key)?; if !map.is_empty() { b.set_servername_callback(move |ssl, _alert| {