Bug #78362 [NEW]: cURL doesn't respect CURLOPT_SSLVERSION

From: mah at jump-ing dot de Operating system: Ubuntu 19.04 PHP version: 7.3.8 Package: cURL related Bug Type: Bug Bug description:cURL doesn't respect CURLOPT_SSLVERSION Description: ------------ Trying to connect with an intentionally lower TLS version, set by CURLOPT_SSLVERSION, connects with the highest supported TLS version instead. This makes the CURLOPT_SSLVERSION setting pretty moot. Test script: --------------- <?php echo 'PHP version: ' . phpversion() . PHP_EOL; echo 'cURL version: ' . curl_version()['version'] . PHP_EOL; $ch = curl_init('https://www.howsmyssl.com/a/check'); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); //curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_0); curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1); //curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2); $data = curl_exec($ch); curl_close($ch); $json = json_decode($data); echo ($data ? $json->tls_version : 'curl request failed') . PHP_EOL; Expected result: ---------------- This output: PHP version: 7.3.7-2+ubuntu19.04.1+deb.sury.org+1 cURL version: 7.64.0 TLS 1.1 Actual result: -------------- This output (last line), no matter what's choosen for CURLOPT_SSLVERSION: PHP ... cURL ... TLS 1.3 -- Edit bug report at https://bugs.php.net/bug.php?id=78362&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78362&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78362&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78362&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78362&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78362&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78362&r=support Expected behavior: https://bugs.php.net/fix.php?id=78362&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78362&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78362&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78362&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78362&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78362&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78362&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78362&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78362&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78362&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78362&r=mysqlcfg