Default TLS mode now accepts TLS v1.2, v1.1 and v1.0.

ChangeLog.txt

@@ -1,3 +1,5 @@
+- Default TLS mode now accepts TLS v1.2, v1.1 and v1.0.
+
 1.3.2 - 2014xxxx
 ================
 

man/mosquitto.conf.5.xml

@@ -740,8 +740,9 @@
  used for this listener. Possible values are
  <replaceable>tlsv1.2</replaceable>,
  <replaceable>tlsv1.1</replaceable> and
- <replaceable>tlsv1</replaceable>. Defaults to
- <replaceable>tlsv1.2</replaceable>.</para>
+ <replaceable>tlsv1</replaceable>. If left unset,
+ the default of allowing all of TLS v1.2, v1.1 and
+ v1.0 is used.</para>
  </listitem>
  </varlistentry>
  <varlistentry>
@@ -800,8 +801,9 @@
  used for this listener. Possible values are
  <replaceable>tlsv1.2</replaceable>,
  <replaceable>tlsv1.1</replaceable> and
- <replaceable>tlsv1</replaceable>. Defaults to
- <replaceable>tlsv1.2</replaceable>.</para>
+ <replaceable>tlsv1</replaceable>. If left unset,
+ the default of allowing all of TLS v1.2, v1.1 and
+ v1.0 is used.</para>
  </listitem>
  </varlistentry>
  <varlistentry>

mosquitto.conf

@@ -171,7 +171,7 @@
 #keyfile
 
 # This option defines the version of the TLS protocol to use for this listener.
-# The default value will always be the highest version that is available for
+# The default value allows v1.2, v1.1 and v1.0, if they are all supported by
 # the version of openssl that the broker was compiled against. For openssl >=
 # 1.0.1 the valid values are tlsv1.2 tlsv1.1 and tlsv1. For openssl < 1.0.1 the
 # valid values are tlsv1.

src/net.c

@@ -342,13 +342,13 @@ int mqtt3_socket_listen(struct _mqtt3_listener *listener)
  if((listener->cafile || listener->capath) && listener->certfile && listener->keyfile){
 #if OPENSSL_VERSION_NUMBER >= 0x10001000L
  if(listener->tls_version == NULL){
- listener->ssl_ctx = SSL_CTX_new(TLSv1_2_server_method());
+ listener->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
  }else if(!strcmp(listener->tls_version, "tlsv1.2")){
  listener->ssl_ctx = SSL_CTX_new(TLSv1_2_server_method());
  }else if(!strcmp(listener->tls_version, "tlsv1.1")){
  listener->ssl_ctx = SSL_CTX_new(TLSv1_1_server_method());
  }else if(!strcmp(listener->tls_version, "tlsv1")){
- listener->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
+ listener->ssl_ctx = SSL_CTX_new(TLSv1_server_method());
  }
 #else
  listener->ssl_ctx = SSL_CTX_new(SSLv23_server_method());