title: Default SSLLevel on Mac OS 10.9 onwards when using NSURLConnection
body: <p>We have a legacy app which gets built against <strong>Mac 10.6</strong> sdk. We are making use of <strong><code>NSURLMutableRequest</code></strong> and <strong><code>NSURLConnection</code></strong> to make web calls. Using Wireshark, I have noticed that on 10.9 - 10.11.2 all these calls get made on TLSv1. On <strong>10.11.6 onwards(also 10.13 beta)</strong> these get made on <strong>TLSv1.2</strong>.</p>
  
  <p>I changed the code to force TLSv1.2 using <strong><code>CFURLRequestSetSSLProperties</code>(dlsym)</strong>. I set <strong><code>kCFStreamSSLLevel</code></strong> to "<code>kCFStreamSocketSecurityLevelTLSv1_2</code>". After these I can see that calls get made on TLSv1.2 now.</p>
  
  <p>From <strong>Apple documentation on <code>kCFStreamSSLLevel</code> :</strong></p>
  
  <blockquote>
    <p>By default, a stream’s security level is
    kCFStreamSocketSecurityLevelNegotiatedSSL.</p>
  </blockquote>
  
  <p>and from <code>kCFStreamSocketSecurityLevelNegotiatedSSL</code> : </p>
  
  <blockquote>
    <p>Specifies that the highest level security protocol that can be
    negotiated be set as the security protocol for a socket stream.</p>
  </blockquote>
  
  <p>I know that TLSv1.2 is supported on 10.9. As a test, I set <strong><code>kCFStreamSSLLevel</code></strong> to 
  <strong><code>kCFStreamSocketSecurityLevelNegotiatedSSL</code></strong> and on 10.9 it still made calls to <strong>TLSv1</strong>. </p>
  
  <p>I have 2 questions :</p>
  
  <ol>
  <li><p>Why do calls gets made on <strong>TLSv1</strong> for <strong>10.9-10.11.2?</strong> Shouldn't they automatically choose highest version available i.e. <strong>TLSv1.2</strong>.</p></li>
  <li><p>When using <strong><code>kCFStreamSocketSecurityLevelTLSv1_2</code></strong>, is there fallback to lower versions if server doesn't support TLSv1.2 or the call will simply fail?
  I found this while checking :</p></li>
  </ol>
  
  <blockquote>
    <p>kCFStreamSocketSecurityLevelNegotiatedSSL  </p>
    
    <p>Discussion: Stream
    property value, for both set and copy operations. Indicates to use TLS
    or SSL with fallback to lower versions. This is what HTTPS does, for
    instance.</p>
  </blockquote>
  
  <p>There's no such declaration for <strong><code>kCFStreamSocketSecurityLevelTLSv1_2</code></strong> or even <strong><code>kCFStreamSocketSecurityLevelTLSv1</code></strong>. So will they fallback to lowers versions or not?</p>