Re: Troubles with SSL ciphers

On 2026/07/06 11:50 AM, Viktor Dukhovni via Exim-users wrote:
> How does Exim implement EC curve (key exchange group selection)?  Does
> it map the names to "nids" and use the legacy SSL_CTX_set1_curves()
> or SSL_CTX_set1_groups() interfaces?  Or does Exim use the now
> preferred SSL_set1_groups_list() / SSL_set1_curves_list API?

The former, that being the only way available when that coding was done.
> Only the latter string-based interfaces supports the new ML-KEM-based
> hybrid and pure algorithms, when compiled and linked with OpenSSL 3.5 or
> later.

Ah, so OpenSSL is gratuitously inconsistent.  Wonderful.

So to remain buildable against older OpenSSL versions we'd have to
add yet more #ifdeffery to the source.  Glorious.
-- 
Cheers,
   Jeremy

If you get the feeling I'm tired of all this... you are welcome
to volunteer.

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki