[slabko]

Problem

The scheduled macOS build (ssl) job started failing on 2026-10-19:
https://github.com/ClickHouse/clickhouse-cpp/actions/runs/39179361295/job/117828616117

Remote_GH_API_TLS_wrong_TLS_version/ConnectionFailedClientTest.ValidateConnectionError/0
Expected exception message: no protocols available
Actual exception message  : OpenSSL error: 0 : Unknown SSL error

Homebrew's openssl formula moved from openssl@3 3.6.4 to openssl@4 4.0.3 and OpenSSL 4.0 removed SSLv3 entirely ("Removed support for SSLv3"). ssl_set_version_bound() now requires version > SSL3_VERSION, so SSL_CTX_set_max_proto_version(ctx, SSL3_VERSION) returns 0 without pushing anything onto the error queue. HANDLE_SSL_CTX_ERROR in clickhouse/base/sslsocket.cpp therefore throws OpenSSL error: 0 : Unknown SSL error before any connection is attempted (note the 0 ms runtime in the log). On OpenSSL 3 the bound is accepted and SSL_connect later fails with SSL_R_NO_PROTOCOLS_AVAILABLE.

Fix

Replace the SSLv3 ceiling with an impossible min/max window:

.SetMinProtocolVersion(TLS1_3_VERSION)
.SetMaxProtocolVersion(TLS1_2_VERSION)

Both bounds are valid on OpenSSL 1.1.0+, 3.x and 4.x, so context setup succeeds; ssl_get_min_max_version() then finds no enabled version and SSL_connect fails with no protocols available on every version. Unlike e.g. SetMaxProtocolVersion(TLS1_VERSION), this does not depend on security level or no-tls1* build options. Test name and expected message are unchanged.