I have a client which connects to a server securely on multiple protocols, namely MQTT and HTTPS.
Because of the following CVE, CVE-2009-3555, we decided to disable all client-initiated session renegotiation. We also decided to keep server-initiated session renegotiation, because we can't afford TLS handshake overhead.
For MQTT we use PahoMQTTC, and for HTTPS we use libcurl both with OpenSSL v1.1.1.
- How to disable client-initiated session renegotiation entirely from my side (the client) in OpenSSL or by using TLS/SSL params in the used libraries?
I understand that in order for the client to renegotiate the keys/session, it should send a new Client Hello message to start the renegotiation.
- How to prevent OpenSSL from doing this?
I see that OpenSSL has this option, SSL_OP_NO_RENGOTIATION, which I think can be used to disable the renegotiation from the client side but I'm afraid it will disable the client handling server-initiated renegotitaion as well.