Re: [exim/exim] tls_eccurve does not accept multiple entries (Issue #2298)

On 2026/07/19 4:18 AM, Viktor Dukhovni via Exim-dev wrote:
> On Sat, Jul 18, 2026 at 11:13:33PM +0100, jgh via Exim-dev wrote:
> 
>> 2703d8ff89 ( https://code.exim.org/exim/exim/commit/2703d8ff893b ) added full tuple-list support for tls_eccurve
> 
> FWIW, I am puzzled by the references to OpenSSL 3.3 in that patch.
> The SSL_CTX_set1_groups_list() function dates back to OpenSSL 1.1.0.
> 
> As for "tuples", which are sub-lists of roughly equivalent key exchange
> methods (KEMs or (EC)DHE groups) with the overall setting being a list
> of said tuples, those are new as of OpenSSL 3.5.  So I am not aware of
> anything related to setting key exchange "groups" that is specifically
> dependent on OpenSSL 3.3 and up.

I was going by the documentation:

https://docs.openssl.org/master/man3/SSL_CTX_set1_curves/#see-also

"Support for ignoring unknown groups in SSL_CTX_set1_groups_list()
  and SSL_set1_groups_list() was added in OpenSSL 3.3."

- which I read as "not full support until then".  Perhaps that should
be amended to cover the "tuples" point?
-- 
Cheers,
   Jeremy