Re: introduce a function like SSL_CTX_set_security_standards()?

> How is this proposal different to the existing
> `SSL_CTX_set_security_level()`?

Those levels are about protocols and key lengths, and don't effect most
ciphers, currently only level 2 is really usable for sites that use
RSA-2048 certificates.    

If I read the original post correctly, the suggestions was similar to
the Mozilla recommendations that many follow:

https://wiki.mozilla.org/Security/Server_Side_TLS

With modern, intermediate and backward compatibilities relating the
whether you want older browsers to access web sites, with lists of the
recommended ciphers for each list.  Intermediate only has 12 ciphers
for TLS 1.2 and 1.3, whereas OpenSSL has dozens.  Modern is TLS 1.3
only so restricting for older browsers.  

Not sure if Mozilla is still updating these recommendations, last
change was in 2023.   

The OpenSSL library I maintain uses security level and Mozilla ciphers
lists for servers, but having OpenSSL allow restricted cipher suites
would make support so much easier.  

Angus

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/memo.20250505124439.29912A%40magsys.adsl.magsys.co.uk.