Use OpenSSL DTLS_method & TLS_server_method when available

[MSP-Greg]

2nd commit changes a require in Rakefile to require_relative...

[MSP-Greg]

This PR replaces some of the code in #1788 & #1799.

Sometime soon, I'll review the code in them and generate a new PR.

[nateberkopec]

• Needs a changelog entry
• I'm going to say the trusty CI build covers this testing-wise

[MSP-Greg]

Needs a changelog entry

Done.

I'm going to say the trusty CI build covers this testing-wise

Agreed. Fixes issue #1833

[MSP-Greg]

@nateberkopec

Thanks. Since there's some overlap (my mistake), I'll now combine #1788 & #1799 with another PR. Hopefully, SSL tests will then pass for any OpenSSL build/configuration and be a good indicator of functionality.

I agree that a MiniSSL::Context#min_version= method/attr is best left for later...

[MSP-Greg]

@nateberkopec, et al

I saw the Friday release mention.

Question: Don't know future plans re releases, but I think one thing people might want is to also have a no_tlsv1_1= method to lock Puma to TLSv1.2 or higher.

Make it so #no_tlsv1_1 = true overrides #no_tlsv1 = false.

Ideally, MiniSSL::Context#min_version= is probably a better solution, but given that new TLS versions are really uncommon, having two 'no_' methods isn't cumbersome. Maybe when TLSv1.4 or TLSv2.0 is released five years from now...

Thoughts? Mention because it is much easier than MiniSSL::Context#min_version=...

[nateberkopec]

I think one thing people might want is to also have a no_tlsv1_1= method to lock Puma to TLSv1.2 or higher.

That's fine in the near-term I think. Probably for 4.1.

[MSP-Greg]

Ok, so not for the next release?

It's relatively easy to add, so I could add it when I combine #1788 & #1799

IOW, generate the new PR (and include no_tlsv1_1=) within the next few days...

[nateberkopec]

not for the next release?

Correct. I'd like to keep new methods out of 4.0.1.