certmanager, net.http: Disable SSLv3 by default

1 files changed, 1 insertions, 1 deletions

diff --git a/net/http.lua b/net/http.lua
index 9dde6062..8ce47494 100644
--- a/net/http.lua
+++ b/net/http.lua
@@ -175,7 +175,7 @@ function request(u, ex, callback)
 	
 	local sslctx = false;
 	if using_https then
-		sslctx = ex and ex.sslctx or { mode = "client", protocol = "sslv23", options = { "no_sslv2" } };
+		sslctx = ex and ex.sslctx or { mode = "client", protocol = "sslv23", options = { "no_sslv2", "no_sslv3" } };
 	end
 
 	req.handler, req.conn = assert(server.wrapclient(conn, host, port_number, listener, "*a", sslctx));