{"action":"created","issue":{"url":"https://api.github.com/repos/netty/netty/issues/4918","repository_url":"https://api.github.com/repos/netty/netty","labels_url":"https://api.github.com/repos/netty/netty/issues/4918/labels{/name}","comments_url":"https://api.github.com/repos/netty/netty/issues/4918/comments","events_url":"https://api.github.com/repos/netty/netty/issues/4918/events","html_url":"https://github.com/netty/netty/issues/4918","id":137578302,"number":4918,"title":"OpenSSL provider does not work with TLSv1.1 and TLSv1.0","user":{"login":"erimatnor","id":819732,"avatar_url":"https://avatars.githubusercontent.com/u/819732?v=3","gravatar_id":"","url":"https://api.github.com/users/erimatnor","html_url":"https://github.com/erimatnor","followers_url":"https://api.github.com/users/erimatnor/followers","following_url":"https://api.github.com/users/erimatnor/following{/other_user}","gists_url":"https://api.github.com/users/erimatnor/gists{/gist_id}","starred_url":"https://api.github.com/users/erimatnor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erimatnor/subscriptions","organizations_url":"https://api.github.com/users/erimatnor/orgs","repos_url":"https://api.github.com/users/erimatnor/repos","events_url":"https://api.github.com/users/erimatnor/events{/privacy}","received_events_url":"https://api.github.com/users/erimatnor/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"Scottmitch","id":7562868,"avatar_url":"https://avatars.githubusercontent.com/u/7562868?v=3","gravatar_id":"","url":"https://api.github.com/users/Scottmitch","html_url":"https://github.com/Scottmitch","followers_url":"https://api.github.com/users/Scottmitch/followers","following_url":"https://api.github.com/users/Scottmitch/following{/other_user}","gists_url":"https://api.github.com/users/Scottmitch/gists{/gist_id}","starred_url":"https://api.github.com/users/Scottmitch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Scottmitch/subscriptions","organizations_url":"https://api.github.com/users/Scottmitch/orgs","repos_url":"https://api.github.com/users/Scottmitch/repos","events_url":"https://api.github.com/users/Scottmitch/events{/privacy}","received_events_url":"https://api.github.com/users/Scottmitch/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2016-03-01T13:46:40Z","updated_at":"2016-03-02T13:41:48Z","closed_at":null,"body":"Not sure this is an issue with Netty, but I have been struggling to get Netty's OpenSSL context to allow clients to connect with protocols other than TLSv1.2. Although TLSv1.2 works well for most clients, we need to support older clients that only support TLSv1.1 or TLSv1.0 (e.g., older Android versions). If I configure Netty with the JDK SSL provider, then the earlier TLS protocol versions are available but not when using OpenSSL. This is despite the fact that the SSLEngine reports these protocols as supported and the Netty code seems to set SSL.SSL_PROTOCOL_ALL when creating the SSLContext. I've set the cipher list according to Mozilla's recommended list for compatibility, so there should be compatible ciphers available. Am I missing something or is there a bug in the OpenSSL provider? I am using Netty 4.1.CR3 with netty-tcnative-boringssl-static."},"comment":{"url":"https://api.github.com/repos/netty/netty/issues/comments/191242211","html_url":"https://github.com/netty/netty/issues/4918#issuecomment-191242211","issue_url":"https://api.github.com/repos/netty/netty/issues/4918","id":191242211,"user":{"login":"hakvroot","id":1088024,"avatar_url":"https://avatars.githubusercontent.com/u/1088024?v=3","gravatar_id":"","url":"https://api.github.com/users/hakvroot","html_url":"https://github.com/hakvroot","followers_url":"https://api.github.com/users/hakvroot/followers","following_url":"https://api.github.com/users/hakvroot/following{/other_user}","gists_url":"https://api.github.com/users/hakvroot/gists{/gist_id}","starred_url":"https://api.github.com/users/hakvroot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hakvroot/subscriptions","organizations_url":"https://api.github.com/users/hakvroot/orgs","repos_url":"https://api.github.com/users/hakvroot/repos","events_url":"https://api.github.com/users/hakvroot/events{/privacy}","received_events_url":"https://api.github.com/users/hakvroot/received_events","type":"User","site_admin":false},"created_at":"2016-03-02T13:41:48Z","updated_at":"2016-03-02T13:41:48Z","body":"I have encountered the same issue as @erimatnor, also with Netty 4.1.CR3 + netty-tcnative-boringssl-static (@ linux-x86_64). I can still reproduce the issue with Fork15-SNAPSHOT; connecting with a non TLSv1.2 protocol results in\r\n\r\n    io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: error:10000103:SSL routines:OPENSSL_internal:UNSUPPORTED_PROTOCOL"}}