Make ssl.PROTOCOL_SSLv23 default for --ssl-version

Fixes #1249

docs/source/news.rst

@@ -12,6 +12,8 @@ Core
   Use the :ref:`gunicorn-cmd` command-line interface instead.
 - The previously deprecated ``django_settings`` setting has been removed.
   Use the :ref:`raw-env` setting instead.
+- The default value of :ref:`ssl-version` has been changed from
+  ``ssl.PROTOCOL_TLSv1`` to ``ssl.PROTOCOL_SSLv23``.
 
 19.6.0 / 2016/05/21
 ===================

docs/source/settings.rst

@@ -1142,6 +1142,10 @@ ssl_version
 
 SSL version to use (see stdlib ssl module's)
 
+.. versionchanged:: 19.7
+   The default value has been changed from ``ssl.PROTOCOL_TLSv1`` to
+   ``ssl.PROTOCOL_SSLv23``.
+
 .. _cert-reqs:
 
 cert_reqs

gunicorn/config.py

@@ -1755,9 +1755,13 @@ class SSLVersion(Setting):
     section = "SSL"
     cli = ["--ssl-version"]
     validator = validate_pos_int
-    default = ssl.PROTOCOL_TLSv1
+    default = ssl.PROTOCOL_SSLv23
     desc = """\
     SSL version to use (see stdlib ssl module's)
+
+    .. versionchanged:: 19.7
+       The default value has been changed from ``ssl.PROTOCOL_TLSv1`` to
+       ``ssl.PROTOCOL_SSLv23``.
     """
 
 class CertReqs(Setting):