--- sources/tls163/tls.c	2014-04-16 20:33:03.000000000 +0200
+++ sources/tls163/tls.c	2014-10-16 11:15:27.014444872 +0200
@@ -68,9 +68,11 @@
 
 static int	TlsLibInit _ANSI_ARGS_ (()) ;
 
-#define TLS_PROTO_SSL2	0x01
-#define TLS_PROTO_SSL3	0x02
-#define TLS_PROTO_TLS1	0x04
+#define TLS_PROTO_SSL2		0x01
+#define TLS_PROTO_SSL3		0x02
+#define TLS_PROTO_TLS1		0x04
+#define TLS_PROTO_TLS1_1	0x08
+#define TLS_PROTO_TLS1_2	0x10
 #define ENABLED(flag, mask)	(((flag) & (mask)) == (mask))
 
 /*
@@ -508,10 +510,10 @@
     Tcl_Obj	*CONST objv[];
 {
     static CONST84 char *protocols[] = {
-	"ssl2",	"ssl3",	"tls1",	NULL
+	"ssl2",	"ssl3",	"tls1",	"tls1.1", "tls1.2", NULL
     };
     enum protocol {
-	TLS_SSL2, TLS_SSL3, TLS_TLS1, TLS_NONE
+	TLS_SSL2, TLS_SSL3, TLS_TLS1, TLS_TLS1_1, TLS_TLS1_2, TLS_NONE
     };
     Tcl_Obj *objPtr;
     SSL_CTX *ctx = NULL;
@@ -554,6 +556,20 @@
 #else
 		ctx = SSL_CTX_new(TLSv1_method()); break;
 #endif
+    case TLS_TLS1_1:
+#if defined(NO_TLS11)
+		Tcl_AppendResult(interp, "protocol not supported", NULL);
+		return TCL_ERROR;
+#else
+		ctx = SSL_CTX_new(TLSv1_1_method()); break;
+#endif
+    case TLS_TLS1_2:
+#if defined(NO_TLS12)
+		Tcl_AppendResult(interp, "protocol not supported", NULL);
+		return TCL_ERROR;
+#else
+		ctx = SSL_CTX_new(TLSv1_2_method()); break;
+#endif
     default:
 		break;
     }
@@ -726,11 +742,9 @@
 #else
     int ssl3 = 1;
 #endif
-#if defined(NO_SSL2) && defined(NO_SSL3)
     int tls1 = 1;
-#else
-    int tls1 = 0;
-#endif
+    int tls1_1 = 1;
+    int tls1_2 = 1;
     int proto = 0;
     int verify = 0, require = 0, request = 1;
 
@@ -771,8 +785,10 @@
 	OPTBOOL( "-ssl2", ssl2);
 	OPTBOOL( "-ssl3", ssl3);
 	OPTBOOL( "-tls1", tls1);
+	OPTBOOL( "-tls1.1", tls1_1);
+	OPTBOOL( "-tls1.2", tls1_2);
 
-	OPTBAD( "option", "-cadir, -cafile, -certfile, -cipher, -command, -keyfile, -model, -password, -require, -request, -server, -ssl2, -ssl3, or -tls1");
+	OPTBAD( "option", "-cadir, -cafile, -certfile, -cipher, -command, -keyfile, -model, -password, -require, -request, -server, -ssl2, -ssl3, -tls1, -tls1.1 or -tls1.2");
 
 	return TCL_ERROR;
     }
@@ -783,6 +799,8 @@
     proto |= (ssl2 ? TLS_PROTO_SSL2 : 0);
     proto |= (ssl3 ? TLS_PROTO_SSL3 : 0);
     proto |= (tls1 ? TLS_PROTO_TLS1 : 0);
+    proto |= (tls1_1 ? TLS_PROTO_TLS1_1 : 0);
+    proto |= (tls1_2 ? TLS_PROTO_TLS1_2 : 0);
 
     /* reset to NULL if blank string provided */
     if (cert && !*cert)		cert	= NULL;
@@ -1019,6 +1037,10 @@
 #else
 	ctx = SSL_CTX_new(SSLv2_method());
 #endif
+    } else if (ENABLED(proto, TLS_PROTO_TLS1_2)) {
+	ctx = SSL_CTX_new(TLSv1_2_method());
+    } else if (ENABLED(proto, TLS_PROTO_TLS1_2)) {
+	ctx = SSL_CTX_new(TLSv1_1_method());
     } else if (ENABLED(proto, TLS_PROTO_TLS1)) {
 	ctx = SSL_CTX_new(TLSv1_method());
     } else if (ENABLED(proto, TLS_PROTO_SSL3)) {
@@ -1033,9 +1055,12 @@
 	return (SSL_CTX *)0;
     }
     off |= (ENABLED(proto, TLS_PROTO_TLS1) ? 0 : SSL_OP_NO_TLSv1);
+    off |= (ENABLED(proto, TLS_PROTO_TLS1_1) ? 0 : SSL_OP_NO_TLSv1_1);
+    off |= (ENABLED(proto, TLS_PROTO_TLS1_2) ? 0 : SSL_OP_NO_TLSv1_2);
     off |= (ENABLED(proto, TLS_PROTO_SSL2) ? 0 : SSL_OP_NO_SSLv2);
     off |= (ENABLED(proto, TLS_PROTO_SSL3) ? 0 : SSL_OP_NO_SSLv3);
 
+    
     SSL_CTX_set_app_data( ctx, (VOID*)interp);	/* remember the interpreter */
     SSL_CTX_set_options( ctx, SSL_OP_ALL);	/* all SSL bug workarounds */
     SSL_CTX_set_options( ctx, off);	/* all SSL bug workarounds */
--- sources/tls163/tls.tcl	2010-07-27 19:15:47.000000000 +0200
+++ sources/tls163/tls.tcl	2014-10-16 11:07:14.068387259 +0200
@@ -71,12 +71,12 @@
 	set args [lreplace $args $idx [expr {$idx+1}]]
 
 	set usage "wrong # args: should be \"tls::socket -server command ?options? port\""
-	set options "-cadir, -cafile, -certfile, -cipher, -command, -keyfile, -myaddr, -password, -request, -require, -ssl2, -ssl3, or -tls1"
+	set options "-cadir, -cafile, -certfile, -cipher, -command, -keyfile, -myaddr, -password, -request, -require, -ssl2, -ssl3, -tls1, -tls1.1 or -tls1.2"
     } else {
 	set server 0
 
 	set usage "wrong # args: should be \"tls::socket ?options? host port\""
-	set options "-async, -cadir, -cafile, -certfile, -cipher, -command, -keyfile, -myaddr, -myport, -password, -request, -require, -ssl2, -ssl3, or -tls1"
+	set options "-async, -cadir, -cafile, -certfile, -cipher, -command, -keyfile, -myaddr, -myport, -password, -request, -require, -ssl2, -ssl3, -tls1, -tls1.1 or -tls1.2"
     }
     set argc [llength $args]
     set sopts {}
@@ -100,7 +100,9 @@
 	    *,-require	-
 	    *,-ssl2	-
 	    *,-ssl3	-
-	    *,-tls1	{lappend iopts $arg [lindex $args [incr idx]]}
+	    *,-tls1	-
+	    *,-tls1.1	-
+	    *,-tls1.2	{lappend iopts $arg [lindex $args [incr idx]]}
 	    -*		{return -code error "bad option \"$arg\": must be one of $options"}
 	    default	{break}
 	}
