Horton

Re: Retire support for OpenSSL 1.1.1 due to raised API requirements

Daniel Gustafsson <daniel@yesql.se>

View thread View on postgr.es
From: Daniel Gustafsson <daniel@yesql.se>
To: Michael Paquier <michael@paquier.xyz>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2024-09-10T08:44:42Z
Lists: pgsql-hackers 
> On 10 Sep 2024, at 00:53, Michael Paquier <michael@paquier.xyz> wrote:
> 
> On Mon, Sep 09, 2024 at 11:29:09PM +0200, Daniel Gustafsson wrote:
>> Agreed.  OpenSSL 1.1.1 is very different story and I suspect we'll be stuck on
>> that level for some time, but 1.1.0 is gone from production use.
> 
> The cleanup induced by the removal of 1.1.0 is minimal.  I'm on board
> about your argument with SSL_CTX_set_ciphersuites() to drop 1.1.0 and
> simplify the other feature.

Yeah, the change to existing code is trivial but avoiding adding a kluge to
handle versions without the relevant API will save complexity.  Thanks for
review.

This change will be committed together with the TLSv1.3 cipher suite pathcset,
just wanted to bring it up here and not hide it in another thread.

--
Daniel Gustafsson

Commits

  1. Raise the minimum supported OpenSSL version to 1.1.1

  2. Remove support for OpenSSL older than 1.1.0