Re: [Quickfix-developers] SSL connection

[Ming C. <che...@ho...>]

Hi QF developers,

My project requires SSL connection:

List of supported cipher suites:
TLS Version Supported Cipher Suites

TLSv1.0
TLSv1.1
TLSv1.2

So SSLProtocol = all -SSLv2  -SSLv3

should be ok?

If I build QF lib with --with-openssl, then I can use SocketInitiator provided with correct configuration mentioned in README.SSL; otherwise I should use SSLSocketInitiator  ?

Thanks in Advance.
Ming

________________________________
From: Ming Cheng <che...@ho...>
Sent: Thursday, September 10, 2020 12:22 AM
To: qui...@li... <qui...@li...>
Subject: Re: SSL connection

I posted the same question here https://stackoverflow.com/questions/63821185/can-socketinitiator-be-used-for-ssl-connection.
________________________________
From: Ming Cheng
Sent: Wednesday, September 9, 2020 7:57 AM
To: qui...@li... <qui...@li...>
Subject: SSL connection

Hi QF developers,

There is SSLSocketInitiator class in the lib and also under examples folder we can see the following code:

#ifdef HAVE_SSL
    if (isSSL.compare("SSL") == 0)
      initiator = new FIX::ThreadedSSLSocketInitiator ( application, storeFactory, settings, logFactory );
    else if (isSSL.compare("SSL-ST") == 0)
      initiator = new FIX::SSLSocketInitiator ( application, storeFactory, settings, logFactory );
    else
#endif

Long long time ago there was a talk about adding security to fix-msg’s themselves.  But later, the industry found that it is much better to get a secure line between the 2 connections.  So now the entire universe just uses a dedicated encrypted line.

I believe there must be something within SSLSocketInitiator  even a connection is a secured line. Please kindly share something I missed that I'll know that I need to use SSLSocketInitiator for a secured line connection environment.

Warm Regards.
Ming