3 files changed, 13 insertions, 8 deletions
diff --git a/src/network/ssl/qssl.cpp b/src/network/ssl/qssl.cpp
index 63c826a3d7..740131797c 100644
--- a/src/network/ssl/qssl.cpp
+++ b/src/network/ssl/qssl.cpp
@@ -119,12 +119,12 @@ QT_BEGIN_NAMESPACE
     a TLS 1.0 Client Hello, enabling TLSv1_0 and SSLv3 connections.
     On the server side, this will enable both SSLv3 and TLSv1_0 connections.
     \value SecureProtocols The default option, using protocols known to be secure;
-    currently behaves like TlsV1SslV3.
+    currently behaves similar to TlsV1Ssl3 except denying SSLv3 connections that does
+    not upgrade to TLS.
 
-    \note most servers using SSL understand both versions (2 and 3),
-    but it is recommended to use the latest version only for security
-    reasons. However, SSL and TLS are not compatible with each other:
-    if you get unexpected handshake failures, verify that you chose
+    \note most servers understand both SSL and TLS, but it is recommended to use
+    TLS only for security reasons. However, SSL and TLS are not compatible with
+    each other: if you get unexpected handshake failures, verify that you chose
     the correct setting for your protocol.
 */
 
diff --git a/src/network/ssl/qsslcontext_openssl.cpp b/src/network/ssl/qsslcontext_openssl.cpp
index 6daddebba3..c042d98056 100644
--- a/src/network/ssl/qsslcontext_openssl.cpp
+++ b/src/network/ssl/qsslcontext_openssl.cpp
@@ -139,8 +139,11 @@ init_context:
     case QSsl::SslV3:
         sslContext->ctx = q_SSL_CTX_new(client ? q_SSLv3_client_method() : q_SSLv3_server_method());
         break;
-    case QSsl::SecureProtocols: // SslV2 will be disabled below
-    case QSsl::TlsV1SslV3: // SslV2 will be disabled below
+    case QSsl::SecureProtocols:
+        // SSLv2 and SSLv3 will be disabled by SSL options
+        // But we need q_SSLv23_server_method() otherwise AnyProtocol will be unable to connect on Win32.
+    case QSsl::TlsV1SslV3:
+        // SSLv2 will will be disabled by SSL options
     case QSsl::AnyProtocol:
     default:
         sslContext->ctx = q_SSL_CTX_new(client ? q_SSLv23_client_method() : q_SSLv23_server_method());
diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp
index 1d675edbbb..84b0d9c75e 100644
--- a/src/network/ssl/qsslsocket_openssl.cpp
+++ b/src/network/ssl/qsslsocket_openssl.cpp
@@ -280,8 +280,10 @@ int q_X509Callback(int ok, X509_STORE_CTX *ctx)
 long QSslSocketBackendPrivate::setupOpenSslOptions(QSsl::SslProtocol protocol, QSsl::SslOptions sslOptions)
 {
     long options;
-    if (protocol == QSsl::TlsV1SslV3 || protocol == QSsl::SecureProtocols)
+    if (protocol == QSsl::TlsV1SslV3)
         options = SSL_OP_ALL|SSL_OP_NO_SSLv2;
+    else if (protocol == QSsl::SecureProtocols)
+        options = SSL_OP_ALL|SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3;
     else
         options = SSL_OP_ALL;