Re: introduce a function like SSL_CTX_set_security_standards()?

You probably may be interested in the solution named "crypto-policies"
present in Fedora, CentOS, RHEL and some more systems. It ensures
system-wide defaults for cryptographic libraries and correctly written
applications via configuration snippets

SY, Dmitry Belyavsky

Dne ne 4. 5. 2025 0:29 uživatel 'Wiebe Cazemier' via openssl-users <
[email protected]> napsal:

> Hello OpenSSL list,
>
> I regularly deal with security audits. Invariably they will say 'old
> protocols and ciphers enabled'. The current way of dealing with that, both
> as developer and sysop, require constant attention. For instance, you can
> change Nginx's ssl_protocols and ssl_ciphers, but at least the former
> doesn't support disabling only one; you have to hard-code what you enable.
> So at some point, it's outdated again, like when TLS 1.4, or a completely
> new protocol is ever introduced. And as stated, security testers always
> find this, so it's a common reoccurrance that this is not configured. And
> then there are many programs that don't offer the option to change it at
> all.
>
> Especially as a software developer, I would like to outsource the decision
> to OpenSSL. Is it feasible to introduce a function like
> SSL_CTX_set_security_standards(ctx, level), where 'level' can be 'MANUAL,
> OUTDATED, DEPRECATED, RECOMMENDED', or something? This could then work in
> conjunction with things like SSL_CTX_set_min_proto_version(), so that it's
> still possible to require mininum TLS 1.3 in DEPRECATED mode.
>
> Implementation wise, it could SIGABORT whenever the openssl major version
> increases and no defaults have been set, so that it's forced to be
> reevaluated with each major release.
>
> One could even make this level enforceable through openssl.conf. As a
> sysop, I would love to have that control.
>
> Curious about the response.
>
> Kind regards,
>
> Wiebe
>
> --
> You received this message because you are subscribed to the Google Groups
> "openssl-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
> To view this discussion visit
> https://groups.google.com/a/openssl.org/d/msgid/openssl-users/1756347097.65432.1746311371291.JavaMail.zimbra%40halfgaar.net
> .
>

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CADqLbzL8%2BeDFa2UshsF_XxYxpV9vLTCa4tJ9kHnDB4hocLG2MQ%40mail.gmail.com.