+ SSL_CTX_set_session_cache_mode(ssl_ctx_new, SSL_SESS_CACHE_OFF);
+ SSL_CTX_set_verify(ssl_ctx_new, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_accept_all_cb);
+
+ #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
+ (void) SSL_CTX_clear_options(ssl_ctx_new, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
+ #endif
+
+ #ifndef LRB_HAVE_TLS_METHOD_API
+ (void) SSL_CTX_set_options(ssl_ctx_new, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+ #endif
+
+ #ifdef SSL_OP_NO_TLSv1
+ (void) SSL_CTX_set_options(ssl_ctx_new, SSL_OP_NO_TLSv1);
+ #endif
+
+ #ifdef SSL_OP_NO_TICKET
+ (void) SSL_CTX_set_options(ssl_ctx_new, SSL_OP_NO_TICKET);
+ #endif
+
+ #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
+ (void) SSL_CTX_set_options(ssl_ctx_new, SSL_OP_CIPHER_SERVER_PREFERENCE);
+ #endif
+
+ #ifdef SSL_OP_SINGLE_DH_USE
+ (void) SSL_CTX_set_options(ssl_ctx_new, SSL_OP_SINGLE_DH_USE);
+ #endif
+
+ #ifdef SSL_OP_SINGLE_ECDH_USE
+ (void) SSL_CTX_set_options(ssl_ctx_new, SSL_OP_SINGLE_ECDH_USE);
+ #endif
+
+ #ifdef LRB_HAVE_TLS_ECDH_AUTO
+ (void) SSL_CTX_set_ecdh_auto(ssl_ctx_new, 1);
+ #endif
+
+ #ifdef LRB_HAVE_TLS_SET_CURVES
+ (void) SSL_CTX_set1_curves_list(ssl_ctx_new, rb_default_curves);
+ #else
+ # if (OPENSSL_VERSION_NUMBER >= 0x10000000L) && !defined(OPENSSL_NO_ECDH) && defined(NID_secp384r1)
+ EC_KEY *const ec_key = EC_KEY_new_by_curve_name(NID_secp384r1);
+ if(ec_key != NULL)
+ {
+ SSL_CTX_set_tmp_ecdh(ssl_ctx_new, ec_key);
+ EC_KEY_free(ec_key);
+ }
+ else
+ rb_lib_log("%s: EC_KEY_new_by_curve_name failed; will not enable ECDHE- ciphers", __func__);
+ # else
+ rb_lib_log("%s: OpenSSL built without ECDH support; will not enable ECDHE- ciphers", __func__);
+ # endif
+ #endif
+
+
+ if(ssl_ctx)
+ SSL_CTX_free(ssl_ctx);
+
+ ssl_ctx = ssl_ctx_new;
+
+
+ rb_lib_log("%s: TLS configuration successful", __func__);