Skip to content

Commit

Permalink
Issue 6561 - TLS 1.2 stickiness in FIPS mode
Browse files Browse the repository at this point in the history
Description:
TLS 1.3 works with NSS in FIPS mode for quite some time now,
this restriction is no longer needed.

Fixes: #6561

Reviewed by: @mreynolds389 (Thanks!)
  • Loading branch information
vashirov committed Feb 14, 2025
1 parent 699f30e commit 8c3ad7c
Showing 1 changed file with 0 additions and 8 deletions.
8 changes: 0 additions & 8 deletions ldap/servers/slapd/ssl.c
Original file line number Diff line number Diff line change
Expand Up @@ -1929,14 +1929,6 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
*/
sslStatus = SSL_VersionRangeGet(pr_sock, &slapdNSSVersions);
if (sslStatus == SECSuccess) {
if (slapdNSSVersions.max > LDAP_OPT_X_TLS_PROTOCOL_TLS1_2 && fipsMode) {
/*
* FIPS & NSS currently only support a max version of TLS1.2
* (although NSS advertises 1.3 as a max range in FIPS mode),
* hopefully this code block can be removed soon...
*/
slapdNSSVersions.max = LDAP_OPT_X_TLS_PROTOCOL_TLS1_2;
}
/* Reset request range */
sslStatus = SSL_VersionRangeSet(pr_sock, &slapdNSSVersions);
if (sslStatus == SECSuccess) {
Expand Down

0 comments on commit 8c3ad7c

Please sign in to comment.