3 ms·

Use LibreSSL: https://en.wikipedia.org/wiki/LibreSSL#Security_and_vulnerabilities https://en.wikipedia.org/wiki/LibreSSL#Security_and_vulnerab... Support the O

• rkeene2 11y ago
  LibreSSL can't be used everywhere OpenSSL is currently used. Notably (and intentionally) missing is FIPS 140-2 support, which most (almost all?) commercial product that uses OpenSSL will rely upon for selling a FIPS 140-2 compliant or validated product. Personally, I find Network Security Services (NSS) much better designed than OpenSSL/LibreSSL and wish more things would use it. Notably better is the use of an actual database to store objects. This really helps when you are using certificate revocation lists (CRLs) which may be huge blobs that change frequently.
  • jamieb007 11y ago
    in some case, if you're able to switch libraries, you might also be able to switch languages and therefore skip on future issues inherent to C. Consider for example: https://golang.org/pkg/crypto/tls/ https://golang.org/pkg/crypto/tls/
  • X-Istence 11y ago
    Wasn't there recently an announcement that OpenSSL was planning on removing FIPS 140 support in the near future and possible add it back at a later point in time? Specifically mentioned here, OpenSSL 1.1.x won't have FIPS support: https://groups.google.com/forum/#!searchin/mailing.openssl.dev/FIPS%7Csort:date/mailing.openssl.dev/k-71_d9ql_g/s1ItwMr4BAAJ https://groups.google.com/forum/#!searchin/mailing.openssl.d...
    • rkeene2 11y ago
      OpenSSL 1.0.x will likely remain supported (by someone, perhaps if not OpenSSL) for a long time due to this decision.