
== How to fix it in OpenSSL

=== Code examples

The following code samples attempt to create an OpenSSL TLS Client.

==== Noncompliant code example

This sample uses OpenSSL's default TLS algorithms, which are weak
cryptographical algorithms (TLSv1.0 and LTSv1.1).

[source,cpp,diff-id=21,diff-type=noncompliant]
----
#include <openssl/ssl.h>

void encrypt() {
    const SSL_METHOD *method = TLS_method();        // Noncompliant
    SSL_CTX *ctx             = SSL_CTX_new(method);

    SSL *ssl = SSL_new(ctx);
    SSL_connect(ssl);
}
----

==== Compliant solution

[source,cpp,diff-id=21,diff-type=compliant]
----
#include <openssl/ssl.h>

void encrypt() {
    const SSL_METHOD *method = TLS_method();
    SSL_CTX *ctx             = SSL_CTX_new(method);

    SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);

    SSL *ssl = SSL_new(ctx);
    SSL_connect(ssl);
}
----

=== How does this work?

include::../../common/fix/fix.adoc[]
