Re: Configuring to fail when a provider doesn't load

On Wed, Mar 05, 2025 at 07:15:11PM +0000, 'Ladd, Watson' via openssl-users wrote:

> Thanks Vikor! It does however seem that passing in these flags is a
> rather complex process, but for applications that need this should be
> doable.

I tested failing to load a provider with OpenSSL 3.5 and Postfix, and
found that OPENSSL_init_ssl() does not actually return an error in that
case.  Ordinary failure to load a provider is not considered fatal.
However, once the provider failed to load, most of the expected default
algorithms did not get loaded either, so the result was definitely
unusable...

    $ cat test/foo.cnf
    test = openssl_init
    [openssl_init]
    providers = provider_sect
    [provider_sect]
    foo = foo_sect
    [foo_sect]
    activate = 1

    $ posttls-finger -o tls_config_file=$PWD/test/foo.cnf -o tls_config_name=test -c localhost
    posttls-finger: warning: Digest algorithm "sha256" not found
    posttls-finger: warning: disabling TLS support

Lack of sha256 support was found after initialisation appeared to
succeed.

-- 
    Viktor.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/Z8l8tnxxy1qE35OO%40chardros.imrryr.org.