When was TLS 1.2 support added to OpenSSL?

29
votes

Does OpenSSL 0.9.8x support TLS1.2? I looked at the changelog for OpenSSL but didn't find any information on this: https://www.openssl.org/news/changelog.html

1
openssltls1.2
OpenSSL 0.9.8 does not support TLS 1.2. Painting with a broad brush TLS 1.2 first appeared in OpenSSL 1.0.1. You have to check the CHANGELOG to see when a particular TLS 1.2 feature was added. The first entry you are looking for is "Initial TLS v1.2 support" in OpenSSL listed under "Changes between 1.0.0h and 1.0.1". You can also look for Elliptic Curve support, which are the TLS 1.1 changes. TLS 1.1 did not materially change the protocol (IIRC); but it did add cipher suites that required ECC. – jww
Indeed, GitHub does not supported OpenSSL of macOS 10.5 anymore. – Polluks

1 Answers

33
votes

On the official changelog page you provided, under Changes between 1.0.0h and 1.0.1 [14 Mar 2012] you can see Initial TLS v1.2 support.

*) Add TLS v1.2 server support for client authentication. [Steve Henson]

*) Add TLS v1.2 client side support for client authentication. Keep cache of handshake records longer as we don't know the hash algorithm to use until after the certificate request message is received. [Steve Henson]

*) Initial TLS v1.2 client support. Add a default signature algorithms extension including all the algorithms we support. Parse new signature format in client key exchange. Relax some ECC signing restrictions for TLS v1.2 as indicated in RFC5246. [Steve Henson]

*) Add server support for TLS v1.2 signature algorithms extension. Switch to new signature format when needed using client digest preference. All server ciphersuites should now work correctly in TLS v1.2. No client support yet and no support for client certificates. [Steve Henson]

*) Initial TLS v1.2 support. Add new SHA256 digest to ssl code, switch to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256 based ciphersuites. At present only RSA key exchange ciphersuites work with TLS v1.2. Add new option for TLS v1.2 replacing the old and obsolete SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2 methods and version checking. [Steve Henson]

*) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only a few changes are required [...]

TLS 1.2 support is from OpenSSL version 1.0.1.

OpenSSL 0.9.8x is lower than 1.0.1 so it does not support TLS 1.2