From: William Lallemand Date: Tue, 13 Oct 2026 19:12:05 +0000 (+0000) Subject: DOC: configuration: document AWS-LC compatibility restrictions X-Git-Tag: v3.5-dev9~23 X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=3b29de557a742c5d8908dc5d7d6d16d05f146caf;p=haproxy.git DOC: configuration: document AWS-LC compatibility restrictions The configuration manual does not explicitly identify several SSL keywords and sample fetches that are unavailable with AWS-LC. This leaves users without compatibility information when selecting an SSL library or configuring an AWS-LC build. Add compatibility notes to the affected entries, stating the minimum OpenSSL version and the lack of AWS-LC support. This is a documentation change only; runtime behavior is unchanged. That should fix #3532. This should be backported to maintained branches with AWS-LC support (as far as 3.0). Note that some keyword may not exists in previous versions. --- diff --git a/doc/configuration.txt b/doc/configuration.txt index 2060e201f..419781bd7 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -3575,6 +3575,8 @@ ssl-dh-param-file "openssl dhparam ", where size should be at least 2048, as 1024-bit DH parameters should not be considered secure anymore. + Compatibility: OpenSSL >= 1.1.1. Not supported with AWS-LC. + ssl-passphrase-cmd ... This settings is only available when support for OpenSSL was built in. It allows to define a full command line that will be called when an encrypted @@ -3598,6 +3600,8 @@ ssl-propquery foo provider by default, and to fallback on the default provider's one if it was not found. + Compatibility: OpenSSL >= 3.0.0. Not supported with AWS-LC. + ssl-provider This setting is only available when support for OpenSSL was built in and when OpenSSL's version is at least 3.0. It allows to load a provider during init. @@ -3620,6 +3624,8 @@ ssl-provider See also "ssl-propquery" and "ssl-provider-path". + Compatibility: OpenSSL >= 3.0.0. Not supported with AWS-LC. + ssl-provider-path This setting is only available when support for OpenSSL was built in and when OpenSSL's version is at least 3.0. It allows to specify the search path that @@ -3629,6 +3635,8 @@ ssl-provider-path defined. See also "ssl-provider". + Compatibility: OpenSSL >= 3.0.0. Not supported with AWS-LC. + ssl-load-extra-del-ext This setting allows to configure the way HAProxy does the lookup for the extra SSL files. By default HAProxy adds a new extension to the filename. @@ -3733,6 +3741,8 @@ ssl-security-level This directive requires at least OpenSSL 1.1.1. + Compatibility: OpenSSL >= 1.1.1. Not supported with AWS-LC. + ssl-server-verify [none|required] The default behavior for SSL verify on servers side. If specified to 'none', servers certificates are not verified. The default is 'required' except if @@ -4241,6 +4251,8 @@ ssl-engine [algo ] it. In case the ssl-engine is required HAProxy can be rebuild with the USE_ENGINE=1 flag. + Compatibility: OpenSSL >= 1.1.1. Not supported with AWS-LC. + ssl-mode-async Adds SSL_MODE_ASYNC mode to the SSL context. This enables asynchronous TLS I/O operations if asynchronous capable SSL engines are used. The current @@ -4250,6 +4262,8 @@ ssl-mode-async read/write operations (it is only enabled during initial and renegotiation handshakes). + Compatibility: OpenSSL >= 1.1.1. Not supported with AWS-LC. + tune.applet.zero-copy-forwarding { on | off } Enables ('on') of disabled ('off') the zero-copy forwarding of data for the applets. It is enabled by default. @@ -5687,6 +5701,8 @@ tune.ssl.default-dh-param if the server's PEM file of a given frontend does not specify its own DH parameters, then DHE ciphers will be unavailable for this frontend. + Compatibility: OpenSSL >= 1.1.1. Not supported with AWS-LC. + tune.ssl.force-private-cache This option disables SSL session cache sharing between all processes. It should normally not be used since it will force many renegotiations due to @@ -18495,6 +18511,8 @@ npn at the time of writing this. It is possible to enable both NPN and ALPN though it probably doesn't make any sense out of testing. + Compatibility: OpenSSL >= 1.0.1. Not supported with AWS-LC. + prefer-client-ciphers Use the client's preference when selecting the cipher suite, by default the server's preference is enforced. This option is also available on @@ -20021,6 +20039,8 @@ npn replaced with the ALPN extension (see the "alpn" keyword), though this one is only available starting with OpenSSL 1.0.2. + Compatibility: OpenSSL >= 1.0.1. Not supported with AWS-LC. + observe May be used in the following contexts: tcp, http @@ -27085,6 +27105,8 @@ ssl_bc_npn : string the TLS NPN extension was replaced with ALPN. It can be used in a tcp-check or an http-check ruleset. + Compatibility: OpenSSL >= 1.0.1. Not supported with AWS-LC. + ssl_bc_protocol : string Returns the name of the used protocol when the outgoing connection was made over an SSL/TLS transport layer. It can be used in a tcp-check or an @@ -27660,6 +27682,8 @@ ssl_fc_npn : string forces the client to pick a protocol from this list, any other one may be requested. Please note that the TLS NPN extension was replaced with ALPN. + Compatibility: OpenSSL >= 1.0.1. Not supported with AWS-LC. + ssl_fc_protocol : string Returns the name of the used protocol when the incoming connection was made over an SSL/TLS transport layer.