Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OpenSSL::SSL::SSLContext::METHODS in MRI vs JRuby #1874

jordansissel opened this issue Jul 30, 2014 · 2 comments

OpenSSL::SSL::SSLContext::METHODS in MRI vs JRuby #1874

jordansissel opened this issue Jul 30, 2014 · 2 comments


Copy link

Hello! While debugging some TLS stuff, I noticed a few oddities. Specifically, MRI's openssl supports different protocol methods than JRuby does.

I tested with MRI 2.1.2, MRI 1.9.3, and JRuby 1.7.13. Differences:

# Comparing OpenSSL::SSL::SSLContext::METHODS
>> mri212 - jruby
=> [:TLSv1_2, :TLSv1_2_server, :TLSv1_2_client, :TLSv1_1, :TLSv1_1_server, :TLSv1_1_client]
>> jruby - mri212
=> [:SSLv2, :SSLv2_server, :SSLv2_client, :TLS, :"TLSv1.1"]
>> mri193 - jruby
=> []
>> jruby - mri193
=> [:SSLv2, :SSLv2_server, :SSLv2_client, :TLS, :"TLSv1.1"]

Curiosities and concerns:

  • JRuby still supports SSLv2, which might be on purpose, but v2 is pretty broken security-wise.
  • JRuby has a symbol with a dot TLSv1.1 where MRI does not. MRI uses TLSv1_1
  • JRuby doesn't have TLS v1.2 or (or TLSv1.3, but neither does MRI on my system)


% rvm 1.9.3,2.1.2,1.7.13 do ruby -ropenssl -e 'p [RUBY_PLATFORM,RUBY_ENGINE,RUBY_VERSION] => OpenSSL::SSL::SSLContext::METHODS'
{["x86_64-linux", "ruby", "1.9.3"]=>[:TLSv1, :TLSv1_server, :TLSv1_client, :SSLv3, :SSLv3_server, :SSLv3_client, :SSLv23, :SSLv23_server, :SSLv23_client]}
{["x86_64-linux", "ruby", "2.1.2"]=>[:TLSv1, :TLSv1_server, :TLSv1_client, :TLSv1_2, :TLSv1_2_server, :TLSv1_2_client, :TLSv1_1, :TLSv1_1_server, :TLSv1_1_client, :SSLv3, :SSLv3_server, :SSLv3_client, :SSLv23, :SSLv23_server, :SSLv23_client]}
{["java", "jruby", "1.9.3"]=>[:TLSv1, :TLSv1_server, :TLSv1_client, :SSLv2, :SSLv2_server, :SSLv2_client, :SSLv3, :SSLv3_server, :SSLv3_client, :SSLv23, :SSLv23_server, :SSLv23_client, :TLS, :"TLSv1.1"]}
Copy link
Contributor Author

This is possibly a dup of, or related to, #1735, #1733, and #1737.

Copy link
Contributor Author


def protocol(text)
  OpenSSL::SSL::SSLContext::METHODS.find { |x| x.to_s.gsub("_",".") == text }
ctx.version = protocol("TLSv1.1")

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet

No branches or pull requests

3 participants