Do not enable legacy TLS version any longer

2 files changed, 0 insertions, 3 deletions

diff --git a/qmail-remote.c b/qmail-remote.c
index a743e06..14114cf 100644
--- a/qmail-remote.c
+++ b/qmail-remote.c
@@ -487,7 +487,6 @@ static int tls_init(struct ip_mx *current_mx)
     smtptext.len = 0;
     tls_quit_error("ZTLS error initializing ctx");
   }
-  SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
   /* TLS renegotiation is possible cpu resource attack */
   SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION);
   /* SMTP does not suffer from truncation attacks due to its application framing */
diff --git a/qmail-smtpd.c b/qmail-smtpd.c
index 1c26031..de125b8 100644
--- a/qmail-smtpd.c
+++ b/qmail-smtpd.c
@@ -1370,8 +1370,6 @@ void tls_init()
   /* a new SSL context with the bare minimum of options */
   ctx = SSL_CTX_new(TLS_server_method());
   if (!ctx) { tls_err("unable to initialize ctx"); return; }
-  SSL_CTX_set_min_proto_version(ctx, (*childargs) ? TLS1_2_VERSION : TLS1_VERSION);
-  if (!*childargs) SSL_CTX_set_security_level(ctx, 0);
   SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE |
                            SSL_OP_PRIORITIZE_CHACHA);
   /* TLS renegotiation is possible cpu resource attack */