Skip to content

Conversation

@kraemv
Copy link

@kraemv kraemv commented Oct 27, 2025

Hello everyone,
I want to extend rustls-compat to work with variable CryptoProviders. Additionally I added the SSL_group_to_name entrypoint, as this is required by Debian 12 nginx.

The main changes are:

  • Untied the CryptoProvider from the SSLCiphers, as the provider is not static. Now I use the rustls ciphersuite to get the protocol id of an SSLCipher, as rustls ciphersuites are static.
  • Use the awl_lc_rs Ticketer explicitly, as this is not covered in the CryptoProvider API.
  • Added a groups field to a SSLCtx, that contains all supported groups. This allows to implement the SSL_group_to_name entrypoint. The static C Strings are taken from https://github.com/openssl/openssl/blob/eedb6df889fb69b9c4571be5616fa22e6b62dc7c/providers/common/capabilities.c#L154
  • Added some more NIDs for Kyber groups

The main problem for switching the CryptoProvider in the old code was, that APIs outside the CryptoProvider API of rustls were used.

I am happy to discuss the changes!

@kraemv kraemv force-pushed the feature/provider_groups branch 2 times, most recently from 7a0c0a9 to 4a022f7 Compare October 29, 2025 12:30
Added: New Entrypoint to build
Added: New NIDs
Added: Provider can be changed
@kraemv kraemv force-pushed the feature/provider_groups branch from 4a022f7 to d3e0e76 Compare October 29, 2025 12:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant