495 Commits

Author	SHA1	Message	Date
Sashan	095db166f7	Update CHANGES.md ... Co-authored-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29385)	2025-12-19 12:05:09 -05:00
sashan	874552686c	- fix CHANGES.md style ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29385)	2025-12-19 12:02:01 -05:00
Alexandr Nedvedicky	31659fe326	Introduce OPENSSL_ATEXIT_CLEANUP env. variable. ... libcrypto does not arm OPENSSL_cleanup() function as atexit(3) handler by default. If application/user wants libcrypto to install OPENSSL_cleanup() as atexit handler, then OPENSSL_ATEXIT_CLEANUP env. variable must be set. If platform's libc does not provide atexit(3), then OPENSSL_ATEXIT_CLEANUP has no effect. The OPENSSL_atexit() is wrapper of atexit(3) provided by libc now. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29385)	2025-12-19 12:01:59 -05:00
Norbert Pocs	43033e129b	Remove the c_rehash script ... The `openssl rehash` should be used instead. Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29427)	2025-12-19 16:10:24 +01:00
Neil Horman	5ba513fadd	Remove crypto-mdebug-backtrace option from config ... We still build with crypto-mdebug-backtrace enabled in a few ci jobs, but it does nothing. With the upcoming merge of feature/removesslv3, the code changes there prevent the use of this option (i.e. enabling it results in configuration failure). It seems the most sensible thing to do here, given we have a major release is to eliminate the option entirely, as it hasn't done anything since 1.0.2. Fixes openssl/project#1763 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29380)	2025-12-12 19:34:54 -05:00
Simo Sorce	a010fde5b6	Add documentation for digest serialization ... Documents EVP_MD_CTX_[s|des]erialize functions. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28837)	2025-12-12 09:08:34 +01:00
Helen Zhang	1b035166bd	Add SNMPKDF implementation ... In compliance with SP800-135 and RFC7860 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/29195)	2025-12-10 13:21:48 +11:00
Viktor Dukhovni	bf236e07af	Clarify/fix encoder/decoder context docs and code ... In was premature to make OSSL_(EN|DE)CODER_CTX_[sg]et_finalized() be public interfaces. Forunately, these have not yet appeared outside the "master" branch, so we can still retract them. Also, in the case of decoders, the implementation failed to take into account that the context was duplicated before it was returned to the user, and the duplicated copy failed to copy the "finalized" field. This commit also renames "finalized" to "frozen", because finalisation is a misleading term in this context, it suggests resource reclamation during garbage collection or deallocation, not marking a structure partly immutable. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/29206)	2025-12-05 10:07:51 +11:00
Norbert Pocs	696913bdd2	Mention ENGINE removal in CHANGES and NEWS ... Resolves: https://github.com/openssl/project/issues/1423 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29305)	2025-12-04 07:32:18 -05:00
Beat Bolli	8ca421f881	Change hexdump width to a multiple of 8 bytes ... 10, 15 and 18 seem quite unnatural byte counts in the context of hex dumps. Standardize on 24 bytes for signatures (to stay within the 80 characters limit) and 16 bytes for everything else. Adjust all test cert dumps to match the new output format. Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29266)	2025-12-03 17:45:15 +01:00
Bernd Edlinger	134f17d526	Document CVE-2021-4160 ... This was fixed in openssl 3.0.1 by #17258 and assigned CVE-2021-4160 but unfortunately forgotten to mention in the CHANGES and/or NEWS. Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29051)	2025-11-26 18:44:10 +01:00
Daniel Kubec	e64098d090	CRL: Enforce proper handling of ASN1_TIME validation results ... ASN1 correctly validates date fields and reports errors to the error stack. Previously, even when validation failed, a CRL object was still returned and could, in some cases, be successfully used for verification. This change fixes that behavior by ensuring validation errors are properly handled and invalid CRLs are rejected. Fixes #27445 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29107)	2025-11-26 15:43:44 +01:00
David von Oheimb	ec11482675	Remove extra leading '00:' when printing key material with highest byte >= 0x80 ... Removed pseudo-DER encoding of (unsigned) BNs from output of ASN1_bn_print() and print_labeled_bignum() in providers/implementations/encode_decode/encode_key2text.c Also adapt test output reference files where needed. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8136)	2025-11-25 09:09:33 +01:00
Bob Beck	aa0be384d8	Removed ASN1_STRING_data() ... This has been deprecated since 1.1.0 and is in the way for improvements that could make ASN1_STRING opaque. (#29177) Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29149)	2025-11-24 19:18:18 +01:00
Daniel Kubec	3f0fb59095	CHANGES.md: CRL Certificate Issuer and IDP extensions ... Updated CHANGES.md for commit e2990825a2 Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29136)	2025-11-21 14:13:10 +01:00
Igor Ustinov	f480a73610	Added finalized flag to the OSSL_ENCODER/DECODER_CTX structures ... After this flag is set, the generic OSSL_ENCODER/DECODER_CTX_set_*() functions shouldn't be called anymore, so they return error in this case. Fixes #28249 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29120)	2025-11-18 19:35:01 +01:00
Eugene Syromiatnikov	552374022f	CHANGES.md, NEWS.md: update for 3.6.0 ... * Add the release date for 3.5.4 * Various touch-ups aimed at improving consistency of the news * ffixes, wfixes Release: Yes Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28734)	2025-10-17 18:52:09 +02:00
Eugene Syromiatnikov	e2d9f486de	CHANGES.md, NEWS.md: various ffixes ... * Adding missing periods. * Consistently using "OpenSSL" as the project's name. * Fixing the "`EVP_SKEY`" formatting reverted by a merge resolution in f815ee19e0 "Harden RSA public encrypt". * Fitting the lines in 80 characters, do a bit more semantic line breaks. Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28734)	2025-10-17 18:52:09 +02:00
Eugene Syromiatnikov	481eb62f69	CHANGES.md, NEWS.md: update for 3.5.4 ... 3.5.4 CHANGES.md includes the following: * https://github.com/openssl/openssl/pull/28415 * https://github.com/openssl/openssl/pull/28573 * https://github.com/openssl/openssl/pull/28603 3.5.4 NEWS.md includes the following: * https://github.com/openssl/openssl/pull/28603 Release: Yes Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28734)	2025-10-17 18:52:09 +02:00
Tomas Mraz	8886960842	Add CHANGES.md and NEWS.md updates ... Including a few corrections of the previous entries. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>	2025-09-29 14:27:36 +02:00
Ryan Hooper	e5f01903ed	Enable peer verification with s_server's verify_return_error option ... If the option is specified it will now implicitly enable peer verification. The s_client command was already behaved this way, so s_server was updated to match the behavior of s_client. Fixes #15134 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28445)	2025-09-18 17:24:03 +02:00
Eugene Syromiatnikov	4732ce799c	CHANGES.md, NEWS.md: update for 3.6.0-beta1 ... CHANGES.md: * https://github.com/openssl/openssl/pull/28398 * https://github.com/openssl/openssl/pull/28411 * https://github.com/openssl/openssl/pull/28447 * https://github.com/openssl/openssl/pull/28449 NEWS.md: * https://github.com/openssl/openssl/pull/28447 Release: yes Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28547)	2025-09-16 12:07:53 -04:00
Eugene Syromiatnikov	d236a32da6	CHANGES.md, NEWS.md: ffix ... Minor formating cleanups. Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28547)	2025-09-16 12:07:53 -04:00
Viktor Dukhovni	f34b1ad17b	Harden RSA public encrypt ... Check the that the indicated output buffer length is large enough. Fix EVP_SealInit() to initialise the output buffer length to the RSA modulus length, not the input KEK length. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28517)	2025-09-13 20:04:16 -04:00
Dr. David von Oheimb	1c99e070b1	CHANGES.md: add entry on constifying (X509) function parameter ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28033)	2025-09-11 17:56:48 +02:00
Igor Ustinov	c283619a66	Doc changes: the -hmac-env and -hmac-stdin options of openssl-dgst ... will appear in version 4.0 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28497)	2025-09-11 15:26:03 +10:00
Matt Caswell	e26ae2754f	The next version to be released from master is 4.0 ... Now that the 3.6 branch has been created, correct the master branch so that it is clear that the next release from that branch will be 4.0 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28423)	2025-09-04 10:40:04 +01:00
openssl-machine	cca9844f0c	Prepare for 3.7 ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Release: yes	2025-09-02 13:07:27 +00:00
Norbert Pocs	145e909a69	Release news and changelog for version 3.6 ... Release: yes Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28403)	2025-09-02 09:03:23 -04:00
Pauli	730c2d9ccc	changes: add a CHANGES.md entry covering the generated parameter name decoding ... This isn't a user visible change but it's sufficiently noteworthy to justify a changes entry. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/28275)	2025-08-22 15:33:20 +10:00
Dimitri John Ledkov	833a34dac3	fips: add news & changes entry for DetECDSA ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28213)	2025-08-21 09:59:55 +10:00
Pauli	32ff539daf	changes: add note about PCT on key import to the FIPS provider ... This is mandated by FIPS 140-3 IG 10.3.A additional comment 1. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28122)	2025-07-31 20:39:40 +02:00
Daniel Van Geest	d0899abb1b	Implement KEMRecipientInfo (RFC9629) in CMS ... Also add support for ML-KEM in CMS (draft-ietf-lamps-cms-kyber). Add the -recip_kdf and -recip_ukm parameters to `openssl cms -encrypt` to allow the user to specify the KDF algorithm and optional user keying material for each recipient. A provider may indicate which RecipientInfo type is supported for a key, otherwise CMS will try to figure it out itself. A provider may also indicate which KDF to use in KEMRecipientInfo if the user hasn't specified one. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27681)	2025-07-30 11:39:04 +02:00
martin	b1b4b154fd	Add support for TLS 1.3 OCSP multi-stapling for server certs ... Co-authored-by: Michael Krueger Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20945)	2025-07-25 17:24:37 +02:00
Stanciu, Adrian	055dd1d8bb	Add AES-CFB128 optimizations with Intel AVX-512 and VAES ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26902)	2025-07-17 16:29:57 -04:00
Theo Buehler	21f1b677d5	Provide X509_CRL_get0_tbs_sigalg() ... X509_CRL_get0_tbs_sigalg() corresponds to X509_get0_tbs_sigalg() and retrieves the AlgorithmIdentifier inside the TBSCertList which is not currently accessible in any sane way from public API. This PR adds X509_get0_tbs_sigalg() to the public API, documents it, adds a simple regress check so there is coverage and mentions the addition in CHANGES.md. On top of that, fix a typo in .gitignore and clean up some order inconsistencies in X509_get0_signature.pod. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27971)	2025-07-10 14:39:35 +02:00
Pauli	25171e0803	Add changes entry for LMS verification ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27885)	2025-07-10 19:04:37 +10:00
Daniel Van Geest	c6a1d8ea74	HKDF updates ... - prevent fixed-digest HKDF from having its digest changed - implement gettable params in HKDF - update fixed-digest HKDF tests Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27247)	2025-07-10 11:14:19 +10:00
Daniel Van Geest	d1a8d5a833	Add HKDF algorithms with fixed digests. ... Add HKDF-SHA256, HKDF-SHA384 and HKDF-SHA512 which are versions of HKDF that have the digest pre-set. The digest cannot be changed for contexts of these types. RFC 8619 defines algorithm identifiers for these combinations. These algorithm identifiers will be used in future features, e.g. KEMRecipientInfo. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27247)	2025-07-10 11:13:21 +10:00
Michael Baentsch	51ce5499f9	Introduce SSL_OP_SERVER_PREFERENCE to replace SSL_OP_CIPHER_SERVER_PREFERENCE misnomer ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27981)	2025-07-09 12:10:57 +02:00
Neil Horman	f6c400f4cc	CHANGES.md / NEWS.md fixups ahead of release ... Release: yes Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27927)	2025-07-01 12:28:00 +01:00
Alexis Goodfellow	52dba1c098	Begin incorporating stdbool usage when json encoding ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/27812)	2025-06-13 11:26:46 -04:00
sashan	53e5071f34	Document transition from ANSI-C towards C-99 ... The existing NOTES-ANSI.md are renamed to NOTES-C99.md and updated accordingly. INSTALL.md lists C-99 compiler instead of ANSI-C now. Also moving from ANSI-C to C-99 warrants updates to NEWS.md and CHANGES.md. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27751)	2025-06-10 19:58:41 +02:00
Matt Caswell	df5dff26ef	Add a CHANGES.md entry regarding no_renegotiation alert ... Highight the bug being fixed for DTLS users Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27591)	2025-06-04 17:21:42 +02:00
Dmitry Belyavskiy	8109618a1c	CHANGES/NEWS entries for configutl ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27290)	2025-05-08 11:05:42 +10:00
Dimitri John Ledkov	995e9489e6	pkcs12: increase macsaltlen from 8 to 16 as per NIST SP 800-132 ... Align PKCS12 PBMAC1 PBKDF2 salt length with PKCS5_DEFAULT_PBE2_SALT_LEN. With this change, newly created PKCS12 PBMAC1 PBKDF2 keystores use mac salt length of 16 bytes by default. This increases interoperability with FIPS implementations which require at least 16 bytes of salt length. Otherwise FIPS implementations fail to to open keystore with invalid salt length errors (unapproved): Mac verify error: invalid password? 80EBD061AD7F0000:error:1C800070:Provider routines:kdf_pbkdf2_set_ctx_params:invalid salt length:providers/implementations/kdfs/pbkdf2.c:293: 80EBD061AD7F0000:error:118C0103:PKCS12 routines:PBMAC1_PBKDF2_HMAC:internal error:crypto/pkcs12/p12_mutl.c:143: 80EBD061AD7F0000:error:1180006D:PKCS12 routines:PKCS12_verify_mac:mac generation error:crypto/pkcs12/p12_mutl.c:324: 80EBD061AD7F0000:error:1C800070:Provider routines:kdf_pbkdf2_set_ctx_params:invalid salt length:providers/implementations/kdfs/pbkdf2.c:293: 80EBD061AD7F0000:error:118C0103:PKCS12 routines:PBMAC1_PBKDF2_HMAC:internal error:crypto/pkcs12/p12_mutl.c:143: 80EBD061AD7F0000:error:1180006D:PKCS12 routines:PKCS12_verify_mac:mac generation error:crypto/pkcs12/p12_mutl.c:324: The compile time constant is made possible to override with a build time define, such that one can revert back to 8 if so is needed for backwards compatibility. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27446)	2025-05-05 16:15:24 +02:00
20ioppolan	3f98e949d3	Removed references to vxworks because it is an unsupported platform ... Fixes #26558 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26630)	2025-05-05 16:13:35 +02:00
Richard Levitte	6683c886f2	Relax absolut path checking in our 'file' scheme implementation ... So far, we strictly obeyed [RFC 8089], which only allows absolute paths in a 'file:' URI. However, this seems to give a confusing user experience, where something like 'file:foo.pem' wouldn't open foo.pem, even though it's there in the current directory, but 'file:$(pwd)/foo.pem' would. To be less surprising for such use cases, we relax our implementation visavi [RFC 8089] to allow relative paths. [RFC 8089]: https://datatracker.ietf.org/doc/html/rfc8089 Fixes #27461 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27482)	2025-04-25 16:11:25 +02:00
Viktor Dukhovni	f492649b99	Fix default pkey(1) DER output ... This is expected to be PKCS#8, but was defaulting to traditional when possible. Changed default DER output format to PKCS#8 and extended the `-traditional` option to apply also to DER output. Fixes: #21708 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27273)	2025-04-24 21:12:49 +10:00
emery	6509f18c9f	Updated the change log to include SSLv3 being disabled by default. ... This change was implemented into version 1.1.0 and onward. The last version that had SSLv3 enabled was version 1.0.2h, which is why the addition was made where it is. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27289)	2025-04-15 15:36:03 +01:00