3 ms·
Better question is why use OpenSSL over the platform's native TLS library? It's incredibly annoying dealing with OpenSSL when MITMing the connection or just wor
by ziml77 6y ago
Better question is why use OpenSSL over the platform's native TLS library? It's incredibly annoying dealing with OpenSSL when MITMing the connection or just working internal services that I don't want to see the insecure connection warnings on.
- Natsu 6y agoYou should make and trust an internal CA to issue certs for those, at least. You just have to add your root to whatever CAfile equivalent the program uses.
- ziml77 6y agoConfiguring the internal CA is exactly the issue here. Programs that use OpenSSL don't respect the Windows cert store. I have a couple environment variables set to point to a PEM file with the cert, but that only helps in a few cases. Sometimes the easiest thing is going the risky route of using a flag to disable to cert check.
- toast0 6y agoUsing a library you control (even if it's fairly bad) instead of the platform TLS library is super useful. Some platforms don't have a TLS library, but TLS is sometimes required. Some platforms have an outdated library and no reasonable update method. Some platforms have nasty bugs in their libraries. Some platforms have very inconsistent libraries depending on version. You might want to send extensions the platform library doesn't support (SNI used to be pretty hard to use), or to manage the acceptable CA roots (which I understand you dislike). You might want more control over ciphers, so as not to offer ciphers that are outdated. Having one buggy library you ship with your code is better than dealing with a different buggy platform library for each platform.
- jesboat 6y agoOn many platforms, OpenSSL is the standard TLS library.