From 18003c561f3f21228f4bf6cd7c5d7c285e860c94 Mon Sep 17 00:00:00 2001 From: William Lallemand Date: Tue, 13 Oct 2026 20:28:12 +0000 Subject: [PATCH] DOC: configuration: document library compatibility for TLS keywords Several TLS configuration keywords describe their OpenSSL requirements in prose without a standardized Compatibility line, leaving AWS-LC support unclear to readers. Add Compatibility lines for the default bind and server ciphersuites, bind and server ciphersuites, and TLS key logging. These require OpenSSL 1.1.1 or newer and AWS-LC 1.22.0 or newer (API 22). Replace the certificate compression support sentence with a Compatibility line requiring OpenSSL 3.2.0 and explicitly stating that AWS-LC is unsupported. Leave keywords requiring OpenSSL versions below 1.1.1 unchanged. This is a documentation-only change; no runtime behavior is modified. This may be backported to maintained branches containing the corresponding keywords and AWS-LC support (as far as 3.0). --- doc/configuration.txt | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/doc/configuration.txt b/doc/configuration.txt index 25bae6938..648c6a90d 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -3609,6 +3609,8 @@ ssl-default-bind-ciphersuites Please check the "bind" keyword for more information. + Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22). + Example: global ssl-default-bind-ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256 @@ -3685,6 +3687,8 @@ ssl-default-server-ciphersuites "ssl-default-server-ciphers" keyword. Please check the "server" keyword for more information. + Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22). + ssl-default-server-client-sigalgs This setting is only available when support for OpenSSL was built in. It sets the default string describing the list of signature algorithms related to @@ -5851,7 +5855,7 @@ tune.ssl.certificate-compression { auto | off } Configures both backend and frontend sides. - This keyword is supported by OpenSSL >= 3.2.0. + Compatibility: OpenSSL >= 3.2.0. Not supported with AWS-LC. The default value is auto. @@ -5921,6 +5925,8 @@ tune.ssl.keylog { on | off } This is only available with OpenSSL 1.1.1, and useful with TLS1.3 session. + Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22). + If you want to generate the content of a SSLKEYLOGFILE with TLS < 1.3, you only need this line: @@ -18093,6 +18099,8 @@ ciphersuites ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256 ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256 + Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22). + client-sigalgs This setting is only available when support for OpenSSL was built in. It sets the string describing the list of signature algorithms related to client @@ -19523,6 +19531,8 @@ ciphersuites For cipher configuration for TLSv1.2 and earlier, please check the "ciphers" keyword. + Compatibility: OpenSSL >= 1.1.1, AWS-LC >= 1.22.0 (API >= 22). + client-sigalgs May be used in the following contexts: tcp, http, log, peers, ring -- 2.47.3