4 ms·

Who uses LibreSSL on production or in their apps?

• jlg23 9y ago
  Me and all BSD-admins I know. Though after a quick glance at the CVE I doubt any of us is affected.
  • akerro 9y ago
    So, who adopted LibreSSL, OpenBSD, Void Linux and TrueOS?
    • _ikke_ 9y ago
      Alpinelinux (where this bug was found)
      • vesak 9y ago
        Alpine could very well be the largest user of LibreSSL due to its popularity in Linux container circles.
    • ishtu 9y ago
      MacOS ships OpenSSH linked against LibreSSL
    • gbrown_ 9y ago
      I think there are FreeBSD people working on getting it into base. I know people have replaced the base OpenSSL with LibreSSL on their own. Edit: This is not the case as feld has pointed out below.
      • feld 9y ago
        Not currently in the plans because the support window for LibreSSL is significantly shorter than a FreeBSD release support cycle.
        • gbrown_ 9y ago
          Thanks for the correction, I've edited my comment.
      • floatboth 9y ago
        HardenedBSD wanted to do LibreSSL in base but /usr/bin/openssl version on my home server still returns "OpenSSL 1.0.2k-freebsd". I use LibreSSL from ports anyway :) but it'd be nice to have it in base, yeah. By the way I actually do use client certificates on my home server. It's behind my ISP's NAT though, no incoming connections from outside are possible lol
      • jlg23 9y ago
        Yes, you have to roll your own. But for hardened setups one has build hosts anyway, so it's just a single config setting to rule them all.
    • ftigeot 9y ago
      DragonFly uses it for base and packages.
• DorothySim 9y ago
  Note that it is about TLS client certificates so it's not as widespread as it seems (unless you use these certs of course :) ).
  • kroeckx 9y ago
    It's not about client certificates, but it can be a reason why some software might want to do this. The return value of 1 allows the program to deal with verification errors instead of aborting the connection. You can for instance use this to display a proper error message that authentication failed, instead of just closing the connection and getting a generic TLS error message.
  • adekok 9y ago
    EAP-TLS. Wifi authentication for many enterprises and universities. Most of which won't be using LibreSSL, tho...
    • cesarb 9y ago
      Not to mention TLS VPNs like openvpn.
• Panino 9y ago
  OpenELEC, OPNsense, CargOS, TrueOS, drupal.org, and bundled with h2o, plus what others have mentioned.