Build against OpenSSL 4.0: replace TLSv1_2_method()

2026-08-24T01:05:29+00:00

TLSv1_2_method() was deprecated in OpenSSL 1.1.0 and is gone from 4.0, which
is what MXE now builds, so the Windows cross build failed to link it.

The replacement is TLS_method() plus an explicit version range. Pinning both
ends of that range to 1.2 is not tidiness, it is what keeps the protocol where
it was: PICA_TLS_CIPHERLIST and PICA_TLS_ANONDHCIPHERLIST both name TLS 1.2
suites, TLS 1.3 has no anonymous key exchange at all, and
SSL_CTX_set_cipher_list() has no say over which 1.3 suites get used. Letting
1.3 be negotiated would quietly ignore the first list and leave the second
with nothing to offer.

The range lives in PICA_security.h with the other security parameters, so
raising it later is a deliberate edit in one place rather than a side effect.

Also carries a PICA_TIMETOLERANCE define that was already in the tree.

Co-Authored-By: Claude Opus 5 
Claude-Session: https://claude.ai/code/session_01CBqDgvq3Ty6C6BjLFH16bw

changed license from GPL-3.0-or-later to GPL-3.0-only

2019-11-13T13:54:23+00:00

pica-node: implemented anon DH TLS connection stage, reworked newconns

2018-12-14T18:41:27+00:00

moved common peer certificate verification code into new func verify_peer_cert_common(); added check for min RSA key size

2018-07-28T21:00:46+00:00

add header file PICA_security.h to group important security parameters in one place

2018-07-28T15:56:52+00:00

pica-pica/PICA_security.h, branch audio_video_calls

Build against OpenSSL 4.0: replace TLSv1_2_method()

changed license from GPL-3.0-or-later to GPL-3.0-only

pica-node: implemented anon DH TLS connection stage, reworked newconns

moved common peer certificate verification code into new func verify_peer_cert_common(); added check for min RSA key size

add header file PICA_security.h to group important security parameters in one place