From 7c83be84b18cbcf39b2f4859cecaaa13aa53331d Mon Sep 17 00:00:00 2001 From: Andrew Slabko Date: Wed, 21 Oct 2026 21:03:34 +0200 Subject: [PATCH] Fix ssl_ut wrong-TLS-version test on OpenSSL 4 OpenSSL 4.0 removed SSLv3, so SSL_CTX_set_max_proto_version(SSL3_VERSION) now fails outright (with an empty error queue), producing "OpenSSL error: 0 : Unknown SSL error" instead of the expected "no protocols available". Use an impossible min/max protocol range (min TLS1.3 > max TLS1.2) which fails the same way on every OpenSSL version. --- ut/ssl_ut.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/ut/ssl_ut.cpp b/ut/ssl_ut.cpp index 1cb7dd359..d17c85951 100644 --- a/ut/ssl_ut.cpp +++ b/ut/ssl_ut.cpp @@ -161,7 +161,12 @@ INSTANTIATE_TEST_SUITE_P( ClientOptions(ClickHouseExplorerConfig) .SetSSLOptions(ClientOptions::SSLOptions() .SetUseDefaultCALocations(false) - .SetMaxProtocolVersion(SSL3_VERSION)), + // Impossible range (min > max) so that the handshake fails with + // "no protocols available" on every OpenSSL version. SSL3_VERSION + // was used before, but OpenSSL 4.0 removed SSLv3 entirely and + // SSL_CTX_set_max_proto_version(SSL3_VERSION) now fails outright. + .SetMinProtocolVersion(TLS1_3_VERSION) + .SetMaxProtocolVersion(TLS1_2_VERSION)), ExpectingException{"no protocols available"} } ));