[jira] [Commented] (TS-2984) Support OpenSSL's SSL_CONF API

["Susan Hinrichs (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TS-2984?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15120308#comment-15120308 ] 

Susan Hinrichs commented on TS-2984:
------------------------------------

[~jpeach@apache.org]  I agree that we don't need to separate the path from the command.

[~sunwei] do you have an example config file?  I'm also looking at using OPENSSL_config() to load engines?  I assume that we would want to have the user specify a single .conf file, so I want to make sure that the global engine loading can co-exist with the per context crypto settings.

> Support OpenSSL's SSL_CONF API
> ------------------------------
>
>                 Key: TS-2984
>                 URL: https://issues.apache.org/jira/browse/TS-2984
>             Project: Traffic Server
>          Issue Type: Improvement
>          Components: SSL
>            Reporter: Wei Sun
>            Assignee: Susan Hinrichs
>              Labels: yahoo
>             Fix For: sometime
>
>         Attachments: TS-2984.diff
>
>
> The use case is to add a configurable server side supported elliptic curves when serving ECDSA certificate per security's needs. To achieve this, we expect to support OpenSSL's SSL_CONF API in ATS. This also allows a flexible configuration of OpenSSL parameters without the need of implementing additional directives when new features are added to OpenSSL. Note that OpenSSL 1.0.2 or above is required to support this.
> More details of configuration file commands can be found from https://www.openssl.org/docs/ssl/SSL_CONF_cmd.html#SUPPORTED_CONFIGURATION_FILE_COM



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)