Make SSL boring again
blog.cloudflare.com
Make SSL boring again
1–10 of 10 posts
Re: Make SSL boring again
#2TLDR: cloudflare switched from openssl to the Google fork BoringSSL.
They now have out of the box some features they maintained themselves, and have a more stable and maintainable stack.
Re: Make SSL boring again
#3TLDR: cloudflare switched from openssl to the Google fork BoringSSL. They now have out of the box some features they maintained themselves, and have a more stable and maintainable stack.
But they also seem to be supporting some features they previously had out of the box?
Re: Make SSL boring again
#4Why did Cloudflare choose BoringSSL over LibreSSL?
https://boringssl.googlesource.com/boringssl/
> BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
> Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Re: Make SSL boring again
#5Why did Cloudflare choose BoringSSL over LibreSSL? https://boringssl.googlesource.com/boringssl/ > BoringSSL is a fork of OpenSSL that is designed to meet Google's needs. > Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
As a final note we’d like to thank the BoringSSL developers for the great work they poured into the project and for the help they provided us along the way.
Seems like they are working pretty close together and got something out of the deal as well.
Re: Make SSL boring again
#6Why did Cloudflare choose BoringSSL over LibreSSL? https://boringssl.googlesource.com/boringssl/ > BoringSSL is a fork of OpenSSL that is designed to meet Google's needs. > Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Because after Heartbleed we started to look for a performant alternative to OpenSSL that we felt would be safe for us to use.
Re: Make SSL boring again
#7Why are we still calling it SSL? It's like saying Telnet whenever you refer to SSH.
Also: it seems like there's no release or commit signing, unless I missed it? So couldn't you just compromise one user, or commit bot, or git repo location, and basically own all TLS that Cloudflare uses, effectively owning like half of the internet?
Re: Make SSL boring again
#8Why did Cloudflare choose BoringSSL over LibreSSL? https://boringssl.googlesource.com/boringssl/ > BoringSSL is a fork of OpenSSL that is designed to meet Google's needs. > Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Interesting, I would think it would be easier to use LibreSSL for this since the OpenBSD folks are so conservative that the modern APIs are likely to be stable. Maybe they want to use more of the legacy APIs that the OpenBSD folks are excising?
Re: Make SSL boring again
#9Why did Cloudflare choose BoringSSL over LibreSSL? https://boringssl.googlesource.com/boringssl/ > BoringSSL is a fork of OpenSSL that is designed to meet Google's needs. > Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Because after Heartbleed we started to look for a performant alternative to OpenSSL that we felt would be safe for us to use.
But why not LibreSSL?
Re: Make SSL boring again
#10Earlier quoted context omitted.
Because after Heartbleed we started to look for a performant alternative to OpenSSL that we felt would be safe for us to use.
But why not LibreSSL?
LibreSSL doesn't provide the features of BoringSSL that we use so would have required a huge amount of work to use.