ssleay32.dll does not export TLS_method - ssl

Question

I am updating the OpenSSL libraries in my application to version 1.0.2c.
This version supports the TLS 1.0, TLS 1.1 and TLS 1.2 as well the SSL 3.0. I would like to configure my application to automatic negotiate the highest version possible.
I have read the documentation provided in https://www.openssl.org/docs/ssl/SSL_CTX_new.html which says that the TLS_method, TLS_client_method and TLS_server_method methods can do this.
But in the Windows distribution (avaliable in https://www.openssl.org/related/binaries.html) the ssleay32.dll does not export the methods TLS_method, TLS_client_method and TLS_server_method. Other methods, like TLSv1_method, TLSv1_1_method and TLSv1_2_method are exported. However those only accepts a specific version.
What method should I use in order to make the version negotiation automatic? Or should I choose the version at runtime?

Answer 1

I would like to configure my application to automatic negotiate the highest version possible.
Use the following code from SSL/TLS Client on the OpenSSL wiki:
const SSL_METHOD* method = SSLv23_method();
if(method == NULL) handleFailure();
ctx = SSL_CTX_new(method);
if(ctx == NULL) handleFailure();
/* Cannot fail ??? */
const long flags = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
SSL_CTX_set_options(ctx, flags);
It gets you "TLS 1.0 and above".
Note the lower bound really provides a TLS record layer version of TLS 1.0. The upper bound is the TLS client version of TLS 1.2. The record layer carries the encrypted payload. And the SSLv23_method gets you a ClientHello in a particular format (for SSLv3 and above).
Implying the lower bound from the record layer version is how most folks use it, but its not how the standard is written. And the TLS Working Group appears to refuse to provide it that way. The effective argument given is "suppose a client want to use TLS 1.0, 1.2 and 1.3, but not 1.1". I don't know anyone who drops a protocol version like that, so its just a strawman to me.
You can read more about it at one of the answer to Check Server security protocol using openssl.
Related, you should use this cipher suite list:
const char* const PREFERRED_CIPHERS = "HIGH:!aNULL:!MD5:!RC4";
res = SSL_set_cipher_list(ssl, PREFERRED_CIPHERS);
if(res != 1) handleFailure();
As a matter of fact, RSA key transport is no longer favored by the security community, so the following may even be a better choice when using a certificate with a RSA key:
"HIGH:!aNULL:!MD5:!RC4:!kRSA";
The cipher string will provide mostly contemporary security, and it will avoid the obsolete cryptography warning.