# HG changeset patch
# User Stan Hu <stanhu@gmail.com>
# Date 1724208444 0
#      Wed Aug 21 02:47:24 2024 +0000
# Node ID e30e8d27195036ee2dd6985d83c28581794b5f4b
# Parent  b949d255fc0962d33c67b1611f8fe5f257afe89d
Downgrade OpenSSL version to 1.1.1

This reverts the changes in
https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7797
because this breaks LDAP and other client integrations that don't
support TLS 1.2:
https://github.com/openssl/openssl/issues/13299#issuecomment-722124937

TLS 1.0 and 1.1 are supported by OpenSSL 3 if
`SSLContext#security_level=` is set to 0, but as far as I can tell
there's no simple way to ensure that this is enabled by default right
now. So until we do this properly or have a proper deprecation process
for TLS 1.1 and 1.0, we probably need to stay on OpenSSL 1.1.1.

diff --git a/gitlab-ci-config/variables.yml b/gitlab-ci-config/variables.yml
--- a/gitlab-ci-config/variables.yml
+++ b/gitlab-ci-config/variables.yml
@@ -40,4 +40,4 @@
   NIGHTLY_FIPS_REPO: 'nightly-fips-builds'
   QA_TESTS_UPSTREAM_PROJECT: 'gitlab-org/gitlab'
   QA_TESTS_REF: 'master'
-  OPENSSL_VERSION: '3.2.1'
+  OPENSSL_VERSION: '1.1.1'