From f1ddb878af43635e1d1d3aa3e36d7bca0899336a Mon Sep 17 00:00:00 2001 From: reverse Date: Wed, 19 Aug 2026 17:55:31 +0000 Subject: [PATCH] =?UTF-8?q?rustls:=20offer=20TLS=201.2=20only,=20matching?= =?UTF-8?q?=20the=20openssl=20backend=20(mozilla=5Fintermediate)=20?= =?UTF-8?q?=E2=80=94=20advertising=201.3=20as=20well=20pushed=20every=20cl?= =?UTF-8?q?ient=20onto=20a=201.3=20handshake=20openssl=20never=20served,?= =?UTF-8?q?=20so=20a=20client=20fine=20on=201.2=20could=20fail=20to=20conn?= =?UTF-8?q?ect;=20a=20drop-in=20backend=20must=20negotiate=20the=20same=20?= =?UTF-8?q?protocol?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/tls_rustls.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/tls_rustls.rs b/src/tls_rustls.rs index 5698924..ae2ade7 100644 --- a/src/tls_rustls.rs +++ b/src/tls_rustls.rs @@ -163,8 +163,12 @@ fn build_config( let verifier = Arc::new(AcceptAnyClientCert { provider: provider.clone(), }); + // Mirror the openssl backend's version policy (mozilla_intermediate = TLS 1.2) + // so rustls is a true drop-in: every client negotiates the same protocol it did + // on openssl. Offering 1.3 here pushed clients onto a 1.3 handshake openssl never + // served, and some couldn't complete it. let cfg = ServerConfig::builder_with_provider(provider.clone()) - .with_protocol_versions(rustls::ALL_VERSIONS) + .with_protocol_versions(&[&rustls::version::TLS12]) .map_err(err)? .with_client_cert_verifier(verifier) .with_cert_resolver(resolver);