Re: http.sslVersion only specifies minimum TLS version, later versions are allowed

From: Daniel Stenberg <daniel@haxx.se>
Date: May 3, 2021, 20:56 UTC
Message-ID: <nycvar.QRO.7.76.2105032250540.30150@fvyyl>
In-Reply-To: <YJBhH0eLKRSpPFy3@coredump.intra.peff.net>

On Mon, 3 May 2021, Jeff King wrote:

> I think it would also make sense to improve the documentation for 
> http.sslVersion to make it clear that this is a minimum (the current wording 
> is quite misleading).

While improving the http.sslVersion, maybe also consider dropping the special mention of NSS and OpenSSL in there? Maybe just like this:

         The SSL version to use when negotiating an SSL connection, if you
         want to force the default.  The available and default version
-       depend on whether libcurl was built against NSS or OpenSSL and the
-       particular configuration of the crypto library in use. Internally
+       depend on which TLS library libcurl was built to use. Internally
         this sets the 'CURLOPT_SSL_VERSION' option; see the libcurl
         documentation for more details on the format of this option and
         for the ssl version supported. Currently the possible values of

Maybe also consider dropping 'sslv2' and 'sslv3' from the docs now since virtually no TLS library supports them since several years now (as they're considered insecure and bad) and therefor asking curl to use those will more often than not rather cause an error.

-- 
  / daniel.haxx.se