# HG changeset patch # User Stan Hu <stanhu@gmail.com> # Date 1724208444 0 # Wed Aug 21 02:47:24 2024 +0000 # Node ID e30e8d27195036ee2dd6985d83c28581794b5f4b # Parent b949d255fc0962d33c67b1611f8fe5f257afe89d Downgrade OpenSSL version to 1.1.1 This reverts the changes in https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7797 because this breaks LDAP and other client integrations that don't support TLS 1.2: https://github.com/openssl/openssl/issues/13299#issuecomment-722124937 TLS 1.0 and 1.1 are supported by OpenSSL 3 if `SSLContext#security_level=` is set to 0, but as far as I can tell there's no simple way to ensure that this is enabled by default right now. So until we do this properly or have a proper deprecation process for TLS 1.1 and 1.0, we probably need to stay on OpenSSL 1.1.1. diff --git a/gitlab-ci-config/variables.yml b/gitlab-ci-config/variables.yml --- a/gitlab-ci-config/variables.yml +++ b/gitlab-ci-config/variables.yml @@ -40,4 +40,4 @@ NIGHTLY_FIPS_REPO: 'nightly-fips-builds' QA_TESTS_UPSTREAM_PROJECT: 'gitlab-org/gitlab' QA_TESTS_REF: 'master' - OPENSSL_VERSION: '3.2.1' + OPENSSL_VERSION: '1.1.1'