DOC: configuration: document library compatibility for TLS keywords

Several TLS configuration keywords describe their OpenSSL requirements in
prose without a standardized Compatibility line, leaving AWS-LC support
unclear to readers.

Add Compatibility lines for the default bind and server ciphersuites,
bind and server ciphersuites, and TLS key logging. These require OpenSSL
1.1.1 or newer and AWS-LC 1.22.0 or newer (API 22). Replace the certificate
compression support sentence with a Compatibility line requiring OpenSSL
3.2.0 and explicitly stating that AWS-LC is unsupported.

Leave keywords requiring OpenSSL versions below 1.1.1 unchanged. This is
a documentation-only change; no runtime behavior is modified.

This may be backported to maintained branches containing the corresponding
keywords and AWS-LC support (as far as 3.0).

diff --git a/doc/configuration.txt b/doc/configuration.txt
index 25bae693885865a321738b25ff722038c20b5f2f..648c6a90d52ba16674d07e4f9a843aa0feac3294 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -3609,6 +3609,8 @@ ssl-default-bind-ciphersuites <ciphersuites>
 
   Please check the "bind" keyword for more information.
 
+  Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22).
+
   Example:
       global
           ssl-default-bind-ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256
@@ -3685,6 +3687,8 @@ ssl-default-server-ciphersuites <ciphersuites>
   "ssl-default-server-ciphers" keyword. Please check the "server" keyword for
   more information.
 
+  Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22).
+
 ssl-default-server-client-sigalgs <sigalgs>
   This setting is only available when support for OpenSSL was built in. It sets
   the default string describing the list of signature algorithms related to
@@ -5851,7 +5855,7 @@ tune.ssl.certificate-compression { auto | off }
 
   Configures both backend and frontend sides.
 
-  This keyword is supported by OpenSSL >= 3.2.0.
+  Compatibility: OpenSSL >= 3.2.0. Not supported with AWS-LC.
 
   The default value is auto.
 
@@ -5921,6 +5925,8 @@ tune.ssl.keylog { on | off }
 
   This is only available with OpenSSL 1.1.1, and useful with TLS1.3 session.
 
+  Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22).
+
   If you want to generate the content of a SSLKEYLOGFILE with TLS < 1.3, you
   only need this line:
 
@@ -18093,6 +18099,8 @@ ciphersuites <ciphersuites>
           ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256
           ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
 
+  Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22).
+
 client-sigalgs <sigalgs>
   This setting is only available when support for OpenSSL was built in. It sets
   the string describing the list of signature algorithms related to client
@@ -19523,6 +19531,8 @@ ciphersuites <ciphersuites>
   For cipher configuration for TLSv1.2 and earlier, please check the "ciphers"
   keyword.
 
+  Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22).
+
 client-sigalgs <sigalgs>
   May be used in the following contexts: tcp, http, log, peers, ring