about renegotiation

[junnylc]

I use ctxwinsock for my HTTPS server program. When I use myssl to scan the server program, myssl reports that the server program allows renegotiation, which is a serious security vulnerability. How do I prohibit renegotiation? thank you
myssl report: Support client insecure renegotiation

[wqweto]

Fixed in commit 4b093b6

10x for the bug report!

Edit: Did some tests with a VbAsyncSocket server with a valid Let's Encrypt issued certificate

1. Test by myssl.com
2. Test by ssllabs.com

Something is wrong with myssl.com test because it says "protocol error" for IE 8-10 / Win 7 handshake simulation but I just tested accessing the https server from Win7 (IE8) and TLS version 1.2 was negotiated w/ ECDHE-RSA-AES128-SHA just ok.

[junnylc]

thank you very very very much!!success

[junnylc]

you are my idol!!!

[junnylc]

I'd founf the error too

Something is wrong with myssl.com test because it says "protocol error" for IE 8-10 / Win 7 handshake simulation but I just tested accessing the https server from Win7 (IE8) and TLS version 1.2 was negotiated w/ ECDHE-RSA-AES128-SHA just ok.

[junnylc]

Thank you. I have modified the code and the effect is very good. At 2022-06-22 17:05:02, "Vladimir Vissoultchev" ***@***.***> wrote: Fixed in commit 4b093b6 10x for the bug report! — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>