Not really insecure, because all communication over the public Internet is done on TLS 1.2+. Really, it's at worst as insecure as just using HTTP to the mitm pr

Not really insecure, because all communication over the public Internet is done on TLS 1.2+. Really, it's at worst as insecure as just using HTTP to the mitm proxy and then having the proxy do the encryption to the outside world, given that the SSL3 connection is entirely contained in a private network. I had actually suggested that initially, but the software refuses to communicate without SSL (which was a fine policy at the time). Also, SSL3 isn't actually that insecure when there is no possibility of controlling any aspect of client communication. > Why don't you modify the hard-coded `no-ssl3` config and try re-compiling? I was actually missing an option, but it still doesn't work with OpenSSL 3.0. Fortunately, 1.1.1 works with it just fine, including the latest version released just today.