Hi sr-dev
Just a heads-up that I have included a (slightly larger than normal)
commit to 5.8.
This offers provider support (v3) in parallel to ENGINE(v1.1.1).
- provides basic infrastructure for OpenSSL 3 providers
- it can be guarded with -DOPENSSL_NO_PROVIDER (which turns this commit off
completely.
Thanks for your patience with all the tls.so churn.
Regards
Richard
Module: kamailio
Branch: 5.8
Commit: 3d80bc811c75eb0cbcf0f4aee8929a5082b4de6a
URL: https://github.com/kamailio/kamailio/commit/3d80bc811c75eb0cbcf0f4aee8929a5…
Author: S-P Chan <shihping.chan(a)gmail.com>
Committer: S-P Chan <shihping.chan(a)gmail.com>
Date: 2024-03-03T14:38:56+08:00
tls: basic OpenSSL 3 support of provider keys (replaces ENGINE)
- initial support for v3 provider keys (replaces ENGINE from v1.1.1)
- can be disabled behind build flag -DOPENSSL_NO_PROVIDER
- provider keys start with /uri: e.g
private_key = /uri:pkcs11:token=NSS%20Certificate%20DB;type=private;object=Fork-Test-c67cc0e0
- global config:
provider_quirks: 0 | 1
- 0 - default
- 1 - create a new OSS_LIB_CTX* in the child
This integration does not load any providers itself and depends on
the usual
export OPENSSL_CONF=my-openssl.cnf
to configure providers.
(cherry picked from commit 69883dd381368ca219cc52140e71d571775f95d5)
---
Modified: src/modules/tls/tls_domain.c
Modified: src/modules/tls/tls_mod.c
---
Diff: https://github.com/kamailio/kamailio/commit/3d80bc811c75eb0cbcf0f4aee8929a5…
Patch: https://github.com/kamailio/kamailio/commit/3d80bc811c75eb0cbcf0f4aee8929a5…
Module: kamailio
Branch: master
Commit: 69883dd381368ca219cc52140e71d571775f95d5
URL: https://github.com/kamailio/kamailio/commit/69883dd381368ca219cc52140e71d57…
Author: S-P Chan <shihping.chan(a)gmail.com>
Committer: S-P Chan <shihping.chan(a)gmail.com>
Date: 2024-03-03T14:34:47+08:00
tls: basic OpenSSL 3 support of provider keys (replaces ENGINE)
- initial support for v3 provider keys (replaces ENGINE from 1.1.1)
- can be disabled behind build flag -DOPENSSL_NO_PROVIDER
- provider keys start with /uri: e.g
private_key = /uri:pkcs11:token=NSS%20Certificate%20DB;type=private;object=Fork-Test-c67cc0e0
- global config:
provider_quirks: 0 | 1
- 0 - default
- 1 - create a new OSS_LIB_CTX* in the child
This integration does not load any providers itself and depends on
the usual
export OPENSSL_CONF=my-openssl.cnf
to configure providers.
---
Modified: src/modules/tls/tls_domain.c
Modified: src/modules/tls/tls_mod.c
---
Diff: https://github.com/kamailio/kamailio/commit/69883dd381368ca219cc52140e71d57…
Patch: https://github.com/kamailio/kamailio/commit/69883dd381368ca219cc52140e71d57…