From af09abe77ae1b141f2948e2ba18bbf553d8be775 Mon Sep 17 00:00:00 2001 From: absurdfarce Date: Wed, 26 Aug 2026 17:34:29 -0500 Subject: [PATCH 1/2] Bump max TLS protocol version up to TLS 1.3 --- src/ssl/ssl_openssl_impl.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ssl/ssl_openssl_impl.cpp b/src/ssl/ssl_openssl_impl.cpp index f20f006ae..2303774ba 100644 --- a/src/ssl/ssl_openssl_impl.cpp +++ b/src/ssl/ssl_openssl_impl.cpp @@ -542,7 +542,7 @@ OpenSslContext::OpenSslContext() SSL_CTX_set_verify(ssl_ctx_, SSL_VERIFY_NONE, ssl_no_verify_callback); #if (OPENSSL_VERSION_NUMBER >= 0x10100000L) // Limit to TLS 1.2 for now. TLS 1.3 has broken the handshake code. - SSL_CTX_set_max_proto_version(ssl_ctx_, TLS1_2_VERSION); + SSL_CTX_set_max_proto_version(ssl_ctx_, TLS1_3_VERSION); #endif #if DEBUG_SSL SSL_CTX_set_info_callback(ssl_ctx_, ssl_info_callback); From ba55593f42d0102bbb0fffe9d29e3d93f2cf1c33 Mon Sep 17 00:00:00 2001 From: absurdfarce Date: Thu, 27 Aug 2026 01:11:00 -0500 Subject: [PATCH 2/2] A few minor fixes --- include/cassandra.h | 3 ++- src/ssl/ssl_openssl_impl.cpp | 4 +++- tests/src/unit/tests/test_socket.cpp | 2 +- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/include/cassandra.h b/include/cassandra.h index c51bfa287..dc169a103 100644 --- a/include/cassandra.h +++ b/include/cassandra.h @@ -634,7 +634,8 @@ typedef enum CassSslVerifyFlags_ { typedef enum CassSslTlsVersion_ { CASS_SSL_VERSION_TLS1 = 0x00, CASS_SSL_VERSION_TLS1_1 = 0x01, - CASS_SSL_VERSION_TLS1_2 = 0x02 + CASS_SSL_VERSION_TLS1_2 = 0x02, + CASS_SSL_VERSION_TLS1_3 = 0x03 } CassSslTlsVersion; typedef enum CassProtocolVersion_ { diff --git a/src/ssl/ssl_openssl_impl.cpp b/src/ssl/ssl_openssl_impl.cpp index 2303774ba..9e8da5b7a 100644 --- a/src/ssl/ssl_openssl_impl.cpp +++ b/src/ssl/ssl_openssl_impl.cpp @@ -541,7 +541,6 @@ OpenSslContext::OpenSslContext() SSL_CTX_set_cert_store(ssl_ctx_, trusted_store_); SSL_CTX_set_verify(ssl_ctx_, SSL_VERIFY_NONE, ssl_no_verify_callback); #if (OPENSSL_VERSION_NUMBER >= 0x10100000L) - // Limit to TLS 1.2 for now. TLS 1.3 has broken the handshake code. SSL_CTX_set_max_proto_version(ssl_ctx_, TLS1_3_VERSION); #endif #if DEBUG_SSL @@ -632,6 +631,9 @@ CassError OpenSslContext::set_min_protocol_version(CassSslTlsVersion min_version case CassSslTlsVersion::CASS_SSL_VERSION_TLS1_2: method = TLS1_2_VERSION; break; + case CassSslTlsVersion::CASS_SSL_VERSION_TLS1_3: + method = TLS1_3_VERSION; + break; default: // unsupported version return CASS_ERROR_LIB_BAD_PARAMS; diff --git a/tests/src/unit/tests/test_socket.cpp b/tests/src/unit/tests/test_socket.cpp index db79b3d3c..a18d56f57 100644 --- a/tests/src/unit/tests/test_socket.cpp +++ b/tests/src/unit/tests/test_socket.cpp @@ -431,7 +431,7 @@ TEST_F(SocketUnitTest, SslEnforceTlsVersion) { listen(); - settings.ssl_context->set_min_protocol_version(CASS_SSL_VERSION_TLS1_2); + settings.ssl_context->set_min_protocol_version(CASS_SSL_VERSION_TLS1_3); bool is_error; SocketConnector::Ptr connector(new SocketConnector(