2 ms·

For the deprecated TLS algorithms, just use a bunch of reverse proxies at the front using the latest Debian, CentOS, or Ubuntu LTS, with mostly default settings

by est31 3y ago

For the deprecated TLS algorithms, just use a bunch of reverse proxies at the front using the latest Debian, CentOS, or Ubuntu LTS, with mostly default settings. For OpenSSL, app developers don't need it. There is OS builtin libraries to do http requests (which is what was done here). As for certificates, there is plenty of solutions allowing for auto-renewal. It's very easy to set up using automation.

newaccount74 3y ago
> There is OS builtin libraries to do http requests If all you want to do is fetch an URL from a public HTTPS server, then I agree. If you want to do anything even slightly more complex (eg. pin a specific cert, or use TLS with a protocol other than HTTPS) then the built in APIs are almost as bad as OpenSSL (at least on macOS/iOS, I don't know other platforms). > As for certificates, there is plenty of solutions allowing for auto-renewal. It's not a problem on the server side. It's a problem on the client side when the root certs expire. It puts an expiration date on your software.