Thrift provides an SSL implementation and implements some best practices (for example, SSLv2 and SSLv3 are disabled). The current mechanism in the C++ library to control the protocol negotiation is unnecessarily complex.
The current behavior is to use an enumeration to set the protocol level. The methods these call are deprecated in OpenSSL 1.1 and do not provide the desired control.
The proposed new behavior is to:
- Remove SSLProtocol
- Require the consumer to subclass SSLContext and call SSL_CTX_set_option to disable certain behaviors, like negotiation protocol levels.
For example the following SSLContext subclass will allow connections at TLSv1.1 or later, whereas the default will only allow TLSv1.2 or later: