From 67e537385476e1b11b775ac95776aab10f730fcf Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Wed, 15 Jul 2026 13:56:38 +0000
Subject: Remove check for use of TLSv1.2 ciphersuites with TLSv1.1 and
 earlier.

We no longer negotiate any TLS version lower than TLSv1.2, so this is now
redundant.

ok tb@
---
 src/lib/libssl/ssl_clnt.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

(limited to 'src/lib/libssl')

diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index c7db7257b5..d9fdfff2a3 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_clnt.c,v 1.173 2026/06/06 15:24:26 jsing Exp $ */
+/* $OpenBSD: ssl_clnt.c,v 1.174 2026/07/15 13:56:38 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1003,14 +1003,6 @@ ssl3_get_server_hello(SSL *s)
 		goto fatal_err;
 	}
 
-	/* TLS v1.2 only ciphersuites require v1.2 or later. */
-	if ((cipher->algorithm_ssl & SSL_TLSV1_2) &&
-	    s->s3->hs.negotiated_tls_version < TLS1_2_VERSION) {
-		al = SSL_AD_ILLEGAL_PARAMETER;
-		SSLerror(s, SSL_R_WRONG_CIPHER_RETURNED);
-		goto fatal_err;
-	}
-
 	if (!ssl_cipher_in_list(SSL_get_ciphers(s), cipher)) {
 		/* we did not say we would use this cipher */
 		al = SSL_AD_ILLEGAL_PARAMETER;
-- 
cgit v1.2.3-55-g6feb