[fdo-internals] Disabling SSLv3 in FDO use of openSSL - v4.0.0 and v3.9.0

[Greg Boone]

Hi All,

I am planning to update the FDO 3.9.0 and FDO 4.0.0 code streams to disable SSLv3 in our third-party compilation of openSSL. This will involve upgrading to openssl-1.0.1l and adding the 'no-ssl3' configuration option. This change will affect our WMS and WFS providers.

Here is an example of how the openssl build will be configured post-update.

      perl Configure no-asm no-ssl3 VC-WIN64A
      call ms\do_win64a debug64

Here are a few relevant links

http://en.wikipedia.org/wiki/POODLE
https://disablessl3.com/
https://www.openssl.org/news/secadv_20141015.txt

Please let me know if you have any concerns.

Regards,
Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/fdo-internals/attachments/20150213/e293d1ff/attachment.html>