eventmachine/eventmachine — pull request #438 by fabiokung (2013-04-25 02:21:39+00:00)
Title: Add a start_tls to use SSLv3 only

... and disable SSLv2.

Usage:

```ruby
module Handler
def post_init
start_tls(:force_ssl_v3 => true)
end
end
```

This is backwards compatible and the default is still SSLv23. @tmaher can fill us in with reasons why someone would want to completely disable SSLv2 nowadays.

When working on this patch I also did some local tests similar to this:

```ruby
module ServerV3StopAfterHandshake
def post_init
start_tls(:force_ssl_v3 => true)
end

def ssl_handshake_completed
$server_handshake_completed = true
EM.stop_event_loop
end
end

def test_v3_with_external_client
$server_handshake_completed = false
EM.run {
EM.start_server("127.0.0.1", 16784, ServerV3StopAfterHandshake)
EM.system("openssl s_client -quiet -no_ssl2 -ssl3 -connect 127.0.0.1:16784") {}
}

assert($server_handshake_completed)
end
```

But I decided to not include them, as I could not find a similar test using external processes to test EM features, and this would certainly break on some systems without `openssl` installed and/or Windows.