Live data from Hacker News

LibreSSL 3.2.0 – TLS 1.3

ftp.openbsd.org

11–12 of 12 posts

Re: LibreSSL 3.2.0 – TLS 1.3

#11

Post by EdwardDiego » Mon, Jun 01, 2020, 11:37 PM UTC

mperham wrote: post #9

user5994461 wrote: post #5

Earlier quoted context omitted.

Would be nice to patch openssl and python to skip expired certificates too when there is a newer one available.

I believe this was fixed in openssl 1.1.1 but there are millions of devices still on 1.0.x

Yeah, we're seeing it in coworkers still running OSX Mojave (albeit with older LibreSSL instead of OpenSSL) using the default curl. Catalina users seem okay though.

Re: LibreSSL 3.2.0 – TLS 1.3

#12

Post by notaplumber » Tue, Jun 02, 2020, 12:43 PM UTC

jedisct1 wrote: post #10

This is great news! However, note that the OpenSSL API compatibility layer doesn't support TLS 1.3 yet. So, if you're using Nginx or something else that doesn't use the LibreSSL API, you're out of luck for now.

This is simply not true. For a lot software you will get 1.3 automatically, for example mutt and irssi pick it up just fine. The existing APIs will work and LibreSSL will prefer TLS 1.3 over 1.2 if clients/servers support it.

OpenSSL offers some additional APIs for certain TLS 1.3 features, but are hardly mandatory.

Post reply on HN