]> git.kaiwu.me - haproxy.git/commit
REGTEST: ssl: require OpenSSL 1.1.1 for crt-list ciphersuites tests
authorWilliam Lallemand <wlallemand@haproxy.com>
Tue, 13 Oct 2026 12:16:01 +0000 (12:16 +0000)
committerWilliam Lallemand <wlallemand@haproxy.com>
Tue, 13 Oct 2026 12:16:01 +0000 (12:16 +0000)
commit50f1285b484c891787c5c1ea919e4d4b1f7c9eb2
tree89a15205f464b751003aa7c25cc1f8b39e68d369
parente278b8db100fe3a3afe8111af02b7596a86bca0d
REGTEST: ssl: require OpenSSL 1.1.1 for crt-list ciphersuites tests

The TCP and QUIC crt-list ciphersuites tests require TLSv1.3, which
OpenSSL only supports starting with 1.1.1. Their previous library checks
did not impose this minimum version, allowing the tests to run with
older OpenSSL versions that cannot support the configuration.

Require OpenSSL 1.1.1 or later while retaining AWS-LC support. Keep the
QUIC prerequisites separate from the library check so that AWS-LC does
not bypass the QUIC and backend-support restrictions.

The TCP regression passed with OpenSSL 3.5.5 and the QUIC regression
passed with AWS-LC.

This must be backported wherever commit 38398d2476 ("BUG/MEDIUM: ssl:
crt-list ciphers ignored with AWS-LC") is backported, as far as 3.0.
reg-tests/quic/ssl_crt-list_ciphersuites.vtc
reg-tests/ssl/ssl_crt-list_ciphersuites.vtc