Re: Request for Recommended OpenSSL SSL_CTX Settings for Cross-Platform Client-Server Communication

Michael Richardson <mcr-SWp7JaYWvAQV+D8aMU/[email protected]> Sat, 12 Jul 2025 13:34:03 -0400

Newsgroups	gmane.comp.encryption.openssl.user
Message-ID	<[email protected]>

Siddharth Dash <[email protected]> wrote:
    > We are developing a *cross-platform TLS-secured communication system* where
    > OpenSSL acts as both a *client* and a *server*, interfacing with different
    > environments (Windows Schannel, Linux, etc.).

So, it's all OpenSSL 3.x, and no other implementations?
And no communication with outside systems, like HTTPS://public.stuff/
You mention microsoft Schannel, so I think it's not just openssl.
(OTH, I've encountered microsoft trained managers who assumed they were using
Schannel, but they turned out to be using obsolete openssl1.0)

    > To ensure *robust security, compatibility, and performance*, we seek
    > recommendations for optimal *SSL_CTX configurations* for both *client and
    > server* setups.

The defaults are really pretty good.  And by not overriding that, you'll get
updates as OpenSSL does the right thing.
You'll get TLS 1.3 with modern crypto, with fallback to TLS 1.2.
You could turn off TLS 1.2 if this is totally openssl greenfield.

    > We appreciate any *best practices, sample configurations, or references* to
    > ensure secure and interoperable TLS communication across platforms.

Generally, you should think more about how *you* authenticate your TLS
connections, rather than how openssl acts.  If you are using the same pinned
TLS certificate+private key   (I've seen this many times, including copying
a private key associated with a wildcard certificate everywhere), then that's
a bigger concern then anything OpenSSL is doing.  TLS w/PSK authentication
can seem convenient at first, but upon disclosure, it's the hardest to
recover from.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/380.1752341643%40obiwan.sandelman.ca.

signature.asc (application/pgp-signature, 511 B)