diff --git a/fhem/FHEM/01_FHEMWEB.pm b/fhem/FHEM/01_FHEMWEB.pm
index 1ef9b4d30..06829cdd1 100755
--- a/fhem/FHEM/01_FHEMWEB.pm
+++ b/fhem/FHEM/01_FHEMWEB.pm
@@ -164,6 +164,7 @@ FHEMWEB_Initialize($)
reverseLogs:0,1
roomIcons
sortRooms
+ sslVersion
smallscreen:unused
smallscreenCommands:0,1
stylesheetPrefix
@@ -3395,6 +3396,9 @@ FW_widgetOverride($$)
smallscreen landscape mode.
+
sslVersion
+ See the global attribute sslVersion.
+
@@ -4105,6 +4109,10 @@ FW_widgetOverride($$)
Smallscreen Landscape Modus angezeigt.
+ sslVersion
+ Siehe das global Attribut sslVersion.
+
+
diff --git a/fhem/FHEM/98_telnet.pm b/fhem/FHEM/98_telnet.pm
index 32e46b476..21f52c0fd 100644
--- a/fhem/FHEM/98_telnet.pm
+++ b/fhem/FHEM/98_telnet.pm
@@ -22,7 +22,7 @@ telnet_Initialize($)
$hash->{NotifyFn}= "telnet_SecurityCheck";
$hash->{AttrList} = "globalpassword password prompt ".
"allowfrom SSL connectTimeout connectInterval ".
- "encoding:utf8,latin1";
+ "encoding:utf8,latin1 sslVersion";
$hash->{ActivateInformFn} = "telnet_ActivateInform";
my %lhash = ( Fn=>"CommandTelnetEncoding",
@@ -471,9 +471,13 @@ telnet_ActivateInform($;$)
encoding
- Sets the encoding for the data send to the client. Possible values are latin1 and utf8. Default is utf8.
+ Sets the encoding for the data send to the client. Possible values are
+ latin1 and utf8. Default is utf8.
+ sslVersion
+ See the global attribute sslVersion.
+
@@ -634,6 +638,9 @@ telnet_ActivateInform($;$)
Mögliche Werte sind utf8 und latin1. Standardwert ist utf8.
+ sslVersion
+ Siehe das global Attribut sslVersion.
+
diff --git a/fhem/FHEM/HttpUtils.pm b/fhem/FHEM/HttpUtils.pm
index f2fe5b378..8a7760793 100644
--- a/fhem/FHEM/HttpUtils.pm
+++ b/fhem/FHEM/HttpUtils.pm
@@ -185,9 +185,11 @@ HttpUtils_Connect2($)
Log3 $hash, $hash->{loglevel}, $@;
} else {
$hash->{conn}->blocking(1);
+ my $sslVersion = AttrVal($hash->{NAME}, "sslVersion",
+ AttrVal("global", "sslVersion", "SSLv23:!SSLv3:!SSLv2"));
IO::Socket::SSL->start_SSL($hash->{conn}, {
Timeout => $hash->{timeout},
- SSL_version => 'SSLv23:!SSLv3:!SSLv2', #Forum #27565
+ SSL_version => $sslVersion
}) || undef $hash->{conn};
}
}
diff --git a/fhem/FHEM/TcpServerUtils.pm b/fhem/FHEM/TcpServerUtils.pm
index cd8731362..aeb542ff4 100644
--- a/fhem/FHEM/TcpServerUtils.pm
+++ b/fhem/FHEM/TcpServerUtils.pm
@@ -83,6 +83,10 @@ TcpServer_Accept($$)
#$clientinfo[0]->blocking(0); # Forum #24799
if($hash->{SSL}) {
+ # Forum #27565: SSLv23:!SSLv3:!SSLv2', #35004: TLSv12:!SSLv3
+ my $sslVersion = AttrVal($hash->{NAME}, "sslVersion",
+ AttrVal("global", "sslVersion", "TLSv12:!SSLv3"));
+
# Certs directory must be in the modpath, i.e. at the same level as the
# FHEM directory
my $mp = AttrVal("global", "modpath", ".");
@@ -90,8 +94,7 @@ TcpServer_Accept($$)
SSL_server => 1,
SSL_key_file => "$mp/certs/server-key.pem",
SSL_cert_file => "$mp/certs/server-cert.pem",
- #SSL_version => 'SSLv23:!SSLv3:!SSLv2', #Forum #27565
- SSL_version => 'TLSv12:!SSLv3', # Forum #35004
+ SSL_version => $sslVersion,
SSL_cipher_list => 'HIGH:!RC4:!eNULL:!aNULL',
Timeout => 4,
});
diff --git a/fhem/docs/commandref_frame.html b/fhem/docs/commandref_frame.html
index ec0acc96b..98860d2f4 100644
--- a/fhem/docs/commandref_frame.html
+++ b/fhem/docs/commandref_frame.html
@@ -1456,6 +1456,14 @@ The following local attributes are used by a wider range of devices:
overview and by xmllist.
+
+ sslVersion
+ Specifies the accepted cryptography algorithms by all modules using the
+ TcpServices helper module. The current default TLSv12:!SSLv3 is thought
+ to be more secure than the previously used SSLv23:!SSLv3:!SSLv2, but it
+ causes problems with some not updated web services.
+
+
stacktrace
if set (to 1), dump a stacktrace to the log for each "PERL WARNING".
diff --git a/fhem/docs/commandref_frame_DE.html b/fhem/docs/commandref_frame_DE.html
index 26514dfab..706672594 100644
--- a/fhem/docs/commandref_frame_DE.html
+++ b/fhem/docs/commandref_frame_DE.html
@@ -1552,6 +1552,14 @@ Die folgenden lokalen Attribute werden von mehreren Geräten verwendet:
xmllist Befehl, und bei der FHEMWEB Raumansicht geprüft.
+
+ sslVersion
+ Setzt die akzeptierten Crypto-Algorithmen im TcpServices Hilfsmodul.
+ Die Voreinstellung TLSv12:!SSLv3 wird als sicherer erachtet als die
+ vorherige SSLv23:!SSLv3:!SSLv2, aber sie kann Probleme mit nicht
+ ausreichend aktualisierten Netzwerk-Diensten verursachen.
+
+
stacktrace
Falls gesetzt (auf 1), schreibt ins FHEM-Log zusätzlich zu jedem
diff --git a/fhem/fhem.pl b/fhem/fhem.pl
index 3b88d0e8a..281504ac6 100755
--- a/fhem/fhem.pl
+++ b/fhem/fhem.pl
@@ -281,6 +281,7 @@ my @globalAttrList = qw(
restoreDirs
sendStatistics:onUpdate,manually,never
showInternalValues:1,0
+ sslVersion
stacktrace:1,0
statefile
title