<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>I came across a similar problem recently with Indy and did some
research. There is a proposed patch to support Openssl 1.1.1 and
hence TLS1.3. This is discussed on github under</p>
<p><a class="moz-txt-link-freetext" href="https://github.com/IndySockets/Indy/pull/299">https://github.com/IndySockets/Indy/pull/299</a></p>
<p>with a proposed patch published under</p>
<p><a class="moz-txt-link-freetext" href="https://github.com/mezen/Indy/tree/NewOpenSSL_PR">https://github.com/mezen/Indy/tree/NewOpenSSL_PR</a></p>
<p>I have tested this proposed patch out with Lazarus/fpc. It is
clearly work in progress and seems to have been frozen while a
proper upgrade to Openssl 3.2. is developed. There is little by
the way of additional documentation. However, I did get it working
as a code library by</p>
<p>1. Adding to the unit path, in addition to the usual
<indypath>Lib/Core, Lib/Protocols and Lib/System, the </p>
<p><indypath>Lib/Protocols/OpenSSL</p>
<p><indypath>Lib/Protocols/OpenSSL/dynamic</p>
<p>directories, and adding to the include path</p>
<p><indy path>/Lib/FCL</p>
<p>2. Using the IdOpenSSLIOHandlerClient unit instead of the <span
class="pygments-w"></span><span class="pygments-n">IdSSL</span><span
class="pygments-o">,</span><span class="pygments-n">IdSSLOpenSSL</span><span
class="pygments-o"> units.</span></p>
<p><span class="pygments-o">3. For an http client using the
TIdOpenSSLIOHandlerClient class instead of the </span><span
class="pygments-o"></span><span class="pygments-w"></span><span
class="pygments-n">TIdSSLIOHandlerSocketOpenSSL</span><span
class="pygments-o"> class as the httpclient's SSLHandler (no
need for any options).</span></p>
<p><span class="pygments-o">4. compiling and fixing a compile time
bug (stray ':' after and "out").</span></p>
<p><span class="pygments-o">In my test program all then seemed to
work fine with OpenSSL 1.1.1. and the updated Indy source.<br>
</span> </p>
<div class="moz-cite-prefix">On 13/01/2024 08:30, Michael Van
Canneyt via lazarus wrote:<br>
</div>
<blockquote type="cite"
cite="mid:c2406f3d-ebbe-e0fc-2c3c-8093155e97f6@freepascal.org">
<br>
<br>
On Sat, 13 Jan 2024, Bo Berglund via lazarus wrote:
<br>
<br>
<blockquote type="cite">I wrote a commit reporting application for
Windows Server16 back in 2018 using
<br>
then current Lazarus/Fpc.
<br>
It is a command line program called from a hook in subversion to
distribute the
<br>
log message and details of commits among co-workers.
<br>
<br>
It uses Indy 10.6.2 to do its job.
<br>
The mailer class has these in uses:
<br>
{Indy units:}
<br>
IdSMTP,
<br>
IdMessage,
<br>
IdEMailAddress,
<br>
IdIOHandler,
<br>
IdIOHandlerSocket,
<br>
IdIOHandlerStack,
<br>
IdSSL,
<br>
IdSSLOpenSSL,
<br>
IdExplicitTLSClientServerBase,
<br>
IdMessageBuilder,
<br>
<br>
Back mid-december 2023 the emails stopped arriving but the
problem was not
<br>
discovered/reported until I myself recently did a commit and I
did not get the
<br>
expected log message email...
<br>
<br>
Now I have looked in the logfiles the application creates and
found this error
<br>
example:
<br>
<br>
20240111 17:13:35.343 Connecting to mailserver
<br>
20240111 17:13:36.590 EXCEPTION: In SendSvnMessage = Error
connecting with SSL.
<br>
error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol
version
<br>
<br>
Can someone please advice:
<br>
- Is there an external (dll?) file on Windows Server 2016 might
need to be
<br>
updated for ssl to work in email handling using Indy10 with SSL?
<br>
</blockquote>
<br>
Indy 10 uses a completely outdated version of the SSL library,
which does
<br>
not have the most recent cryptographic routines (notably for tls).
<br>
<br>
Most likely the server was updated and now rejects this old
version.
<br>
<br>
There is of course a new version of the openssl library (3.2.x).
<br>
The interface of that library changed, but to the best of my
knowledge, indy does not support it.
<br>
<br>
The sgcWebSockets suite has an updated version of openssl which
should be able to
<br>
support openssl 3, but that is paying software..
<br>
<br>
Michael.
<br>
</blockquote>
</body>
</html>