Issue with tcltls2.0

[AlanGrunwald]

There's a difference in behaviour between tcltls2.0 and tls2.0b2 as illustrated by the attached script

tlsIssue.tcl.txt

With tcltls2.0 the output is

using tls v2.0
failed to use socket
    while executing
"http::geturl https://www.ebu.co.uk/members/api-3.1/ngs/search?forenames=Mike&surname=Lewis"
    invoked from within
"set tok [http::geturl https://www.ebu.co.uk/members/api-3.1/ngs/search?forenames=Mike&surname=Lewis]"
    (file "tlsIssue.tcl.txt" line 8)

With tls2.0b2 the output is

using tls v2.0b2
{"response":{"player":[{"Position":1,"Surname":"Lewis","Forenames":"Mike","Grade":"56.69","GradeBand":"Jack","Maturity":"M","Region":"GLO","Partners"[{"Surname":"Green","Forenames":"Malcolm","Grade":"58.64","GradeBand":"Queen","Maturity":"M"},{"Surname":"Williams","Forenames":"Roger","Grade":"57.16","GradeBand":"Queen","Maturity":"M"},{"Surname":"Nicolson","Forenames":"Alison","Grade":"53.95","GradeBand":"Ten  ","Maturity":"M"}]}],"process_time":"0.0292s"}}

I had a poke around in http.tcl (version 2.10.1) in both cases; I found that the "failed to use socket" error comes from line 2461 (approx) following a comment that it is handling errors from the https protocol.

I'm running on Linux mint (uname -a returns "Linux juanita 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux") with a locally compiled tcl 9.0.3. Both versions of tcl?tls were locally compiled - judging by the names of the directories the source tarball expanded to, they were from revisions 651e6cb534 (2.0b2) and 5d3e3c3bf8 (2.0).

[bohagan1]

Remove the "-tls1 1" argument from your tls::socket command and it should work (it did for me on 2.0 and 2.0b2).

The reason it worked for 2.0b2, but not 2.0 is I simplified the logic for setting which TLS protocols to use. For 2.0, with just the "-tls1 1" argument, you told it to only offer TLS 1.0 and not 1.1, 1.2, or 1.3. Most web servers will refuse connections for anything less than 1.2 nowadays. That's the error you got. In 2.0b2, I always forced TLS 1.2 and 1.3 to be allowed unless you used "-tls1.2 0 -tls1.3 0" to turn them off. Why the change? OpenSSL prefers we specify ranges of allowed protocols now instead of them individually.

As a rule of thumb, in TLS 2.0 you don't need to specify which TLS protocols to use anymore. In fact, it's discouraged unless you really need one of the older protocols.