From: William Lallemand <wlallemand@irq6.net>
Date: Tue, 13 Oct 2026 20:28:12 +0000 (+0000)
Subject: DOC: configuration: document library compatibility for TLS keywords
X-Git-Tag: v3.5-dev10~26
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=442120b49b0537ad4b0c535f4677625f89f60ea5;p=haproxy.git

DOC: configuration: document library compatibility for TLS keywords

Several TLS configuration keywords describe their OpenSSL requirements in
prose without a standardized Compatibility line, leaving AWS-LC support
unclear to readers.

Add Compatibility lines for the default bind and server ciphersuites,
bind and server ciphersuites, and TLS key logging. These require OpenSSL
1.1.1 or newer and AWS-LC 1.22.0 or newer (API 22). Replace the certificate
compression support sentence with a Compatibility line requiring OpenSSL
3.2.0 and explicitly stating that AWS-LC is unsupported.

Leave keywords requiring OpenSSL versions below 1.1.1 unchanged. This is
a documentation-only change; no runtime behavior is modified.

This may be backported to maintained branches containing the corresponding
keywords and AWS-LC support (as far as 3.0).
---

diff --git a/doc/configuration.txt b/doc/configuration.txt
index d29631ef8..63d2c0f74 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -3615,6 +3615,8 @@ ssl-default-bind-ciphersuites <ciphersuites>
 
   Please check the "bind" keyword for more information.
 
+  Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22).
+
   Example:
       global
           ssl-default-bind-ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256
@@ -3691,6 +3693,8 @@ ssl-default-server-ciphersuites <ciphersuites>
   "ssl-default-server-ciphers" keyword. Please check the "server" keyword for
   more information.
 
+  Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22).
+
 ssl-default-server-client-sigalgs <sigalgs>
   This setting is only available when support for OpenSSL was built in. It sets
   the default string describing the list of signature algorithms related to
@@ -5857,7 +5861,7 @@ tune.ssl.certificate-compression { auto | off }
 
   Configures both backend and frontend sides.
 
-  This keyword is supported by OpenSSL >= 3.2.0.
+  Compatibility: OpenSSL >= 3.2.0. Not supported with AWS-LC.
 
   The default value is auto.
 
@@ -5927,6 +5931,8 @@ tune.ssl.keylog { on | off }
 
   This is only available with OpenSSL 1.1.1, and useful with TLS1.3 session.
 
+  Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22).
+
   If you want to generate the content of a SSLKEYLOGFILE with TLS < 1.3, you
   only need this line:
 
@@ -18099,6 +18105,8 @@ ciphersuites <ciphersuites>
           ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256
           ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
 
+  Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22).
+
 client-sigalgs <sigalgs>
   This setting is only available when support for OpenSSL was built in. It sets
   the string describing the list of signature algorithms related to client
@@ -19529,6 +19537,8 @@ ciphersuites <ciphersuites>
   For cipher configuration for TLSv1.2 and earlier, please check the "ciphers"
   keyword.
 
+  Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22).
+
 client-sigalgs <sigalgs>
   May be used in the following contexts: tcp, http, log, peers, ring