Marc Billow
58ecbaab46
OpenSSL 3.x defaults to SECLEVEL=2, which rejects SHA-1 digests in the certificate chain. Samsung's OCF Root CA is SHA-1 signed, so peer verification failed with "ca md too weak" on every connect attempt. SECLEVEL=1 (80-bit minimum) allows SHA-1 in the CA chain while still enforcing meaningful key-strength and cipher constraints. Not going back to SECLEVEL=0 which removes all restrictions.