On Wed, Sep 18, 2024 at 05:38:25PM +0200, Geert Hendrickx via Postfix-users
wrote:
> Oh, I see now. If SSL_CTX_set1_curves_list() is defined, nginx runs
> it directly on the whole list (without checking the elements first).
> OBJ_sn2id is only used for older openssl.
The problem is that IIRC when any of the requested groups are
unsupported the entire list is not loaded. This makes configurations
brittle. Postfix instead probes each element, and requests just
those that are valid, warning about the rest.
This makes it possible to write "forward-looking" configs that will use
newer groups once they're available in the OpenSSL runtime.
> Btw, postfix has no way to NOT set any curves/groups, and let openssl
> choose?
At the moment, there isn't a way to just go with the default OpenSSL
group list, which IIRC at the time was a bit bloated.
--
Viktor.
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
