introduce a function like SSL_CTX_set_security_standards()?

Hello OpenSSL list,

I regularly deal with security audits. Invariably they will say 'old protocols and ciphers enabled'. The current way of dealing with that, both as developer and sysop, require constant attention. For instance, you can change Nginx's ssl_protocols and ssl_ciphers, but at least the former doesn't support disabling only one; you have to hard-code what you enable. So at some point, it's outdated again, like when TLS 1.4, or a completely new protocol is ever introduced. And as stated, security testers always find this, so it's a common reoccurrance that this is not configured. And then there are many programs that don't offer the option to change it at all. 

Especially as a software developer, I would like to outsource the decision to OpenSSL. Is it feasible to introduce a function like SSL_CTX_set_security_standards(ctx, level), where 'level' can be 'MANUAL, OUTDATED, DEPRECATED, RECOMMENDED', or something? This could then work in conjunction with things like SSL_CTX_set_min_proto_version(), so that it's still possible to require mininum TLS 1.3 in DEPRECATED mode. 

Implementation wise, it could SIGABORT whenever the openssl major version increases and no defaults have been set, so that it's forced to be reevaluated with each major release.

One could even make this level enforceable through openssl.conf. As a sysop, I would love to have that control.

Curious about the response. 

Kind regards, 

Wiebe

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/1756347097.65432.1746311371291.JavaMail.zimbra%40halfgaar.net.