denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Load "legacy" provider in OpenSSL 3 for algorithms like MD4, DES etc.

Browse Source 
We still require these algorithms for e.g. EAP-MSCHAPv2, so the option is
enabled, by default.  To use other providers (e.g. fips or even custom
ones), the option can be disabled and the providers to load/activate can
be configured in openssl.cnf.  For instance, the following has the same
effect as enabling the option:

    openssl_conf = openssl_init

    [openssl_init]
    providers = providers

    [providers]
    default = activate
    legacy = activate

    [activate]
    activate = yes
This commit is contained in:
Tobias Brunner
2021-12-08 11:34:13 +01:00
parent 8baa431501
commit f556fce16b
2 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/plugins/openssl.opt
+5
View File
@@ -3,3 +3,8 @@ charon.plugins.openssl.engine_id = pkcs11
charon.plugins.openssl.fips_mode = 0
Set OpenSSL FIPS mode: disabled(0), enabled(1), Suite B enabled(2).
charon.plugins.openssl.load_legacy = yes
Load the legacy provider in OpenSSL 3+ for algorithms like MD4, DES, or
Blowfish (the first two are required for EAP-MSCHAPv2). If disabled, the
default provider is loaded, or those configured in the OpenSSL config.