Correct ca bundle to use

Yes, the client-side workarounds all only work for OpenSSL 1.0.2. OpenSSL 1.0.1 neither supports trusted-first, nor the remove-the-old-root workaround.

On the RHEL 6 thread, users have worked to build OpenSSL 1.0.2 for CentOS/RHEL 6 to be able to apply the workarounds. Similar things could be done for other distros, as there's ABI compatibility between 1.0.1 and 1.0.2. It's usually just a matter of recompiling.

Ubuntu has shipped patches for most of their versions (they've also fixed GnuTLS). However because 14.04 is EOL, they did not patch that. 16.04 got backports though.

5 Likes