nahi/httpclient — pull request #204 by aef (2014-05-06 23:32:05+00:00)
Title: Let OpenSSL decide which TLS protocol version is used by default.

I use Gem in a Box, a Ruby that allows to create personal self-hosted gem repsitories. Gem in a Box uses httpclient to connect to the gem repository. After reviewing my server's TLS setup in the aftermath of the OpenSSL heartbleed bug, I decided only to allow protocol versions of TLSv1 and higher on my server. A decision quite a few fellow administrators made because of security vulnerabilites in SSLv3 and below.

Now after I did this change, Gem in a Box refused to work with the following message:

```
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server hello A: sslv3 alert handshake failure
```

I traced this problem back until I found the source in httpclient. Even though OpenSSL can find the best protocol version to use by itself, you set it only to use SSLv3 by default. I think this is a very bad idea and hereby provide a patch which lets OpenSSL do its own decision again by default.

Please double check my changes because I am not so familiar with OpenSSL itself and the documentation of the Ruby binding are severely lacking. I tested my changes and hope this patch is acceptable.