-
Notifications
You must be signed in to change notification settings - Fork 611
Support loading custom OpenSSL provider #2357
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
When using OpenSSL, allow Squid to use a specific crypto provider named in ssl_provider. Replaces any system-wide configuration specified using openssl.conf.
yadij
commented
Jan 18, 2026
Existing builds will start to see something like this is cache.log on startup:
2026年01月18日 20:46:55| Provider: default( name[24]=OpenSSL Default Provider, version[5]=3.5.4, buildinfo[5]=3.5.4, status=1 )
When ssl_provider legacy is configured:
2026年01月18日 20:46:55| Provider: legacy( name[23]=OpenSSL Legacy Provider, version[5]=3.5.4, buildinfo[5]=3.5.4, status=1 )
@rousskov
rousskov
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for adding this feature. I have not reviewed the entire PR yet, and will have more questions later, but these two change requests should allow you to make progress.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please do not call fatalf() when reacting to a configuration application failure. Throw an exception instead.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Unfortunately this function is not only called during startup. It can be delayed and called later in Squid operation after a reconfigure. The exception handlers for that case are not yet reliable.
FWIW, I planned to fix the above situation with the project moving init things into runners. But that work got stalled.
When using OpenSSL, allow Squid to use a specific
crypto provider named in ssl_provider.
Replaces any system-wide configuration specified
using openssl.conf.