Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-33749

Please stop using OpenSSL ENGINE API in stunnel

XMLWordPrintable

    • stunnel-5.72-5.el10
    • None
    • Important
    • 2
    • rhel-sst-security-crypto
    • ssg_security
    • 26
    • 1
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Red Hat Enterprise Linux
    • Crypto24Q2, Crypto24Q3
    • Removed Functionality
    • Hide
      .`stunnel` does not support OpenSSL ENGINE API

      The `stunnel` TLS offloading and load-balancing proxy no longer supports the previously deprecated OpenSSL ENGINE API. The most common use case was accessing hardware security tokens by using PKCS #11 through the `openssl-pkcs11` package. As a replacement, you can use the `pkcs11-provider`, which uses the new OpenSSL provider API.
      Show
      .`stunnel` does not support OpenSSL ENGINE API The `stunnel` TLS offloading and load-balancing proxy no longer supports the previously deprecated OpenSSL ENGINE API. The most common use case was accessing hardware security tokens by using PKCS #11 through the `openssl-pkcs11` package. As a replacement, you can use the `pkcs11-provider`, which uses the new OpenSSL provider API.
    • Done
    • All
    • None

      Dear colleagues,

      Our scanning identified your component as one of the packages using OpenSSL ENGINE API.

      Engines are not FIPS compatible and corresponding API is deprecated since OpenSSL 3.0. The engine functionality we are aware of (PKCS#11, TPM) is either covered by providers maintained by Crypto Team now or will be covered soon.

      We kindly ask you to implement patches or apply compiling options to eliminate the code relying on ENGINE API. Even if we don’t eliminate the ENGINE API completely for backward binary compatibility, the compilation of applications using the ENGINE API will soon become impossible.

      We kindly ask you to add this work to the nearest sprint. We have a side-tag f41-build-side-86419 to build and a Copr build https://copr.fedorainfracloud.org/coprs/dbelyavs/openssl-no-engine/build/7107098/

      Feel free to reach the Crypto team, Dmitry Belyavskiy, Sahana Prasad, or Clemens Lang directly if you have any problems with the necessary changes.

              cllang@redhat.com Clemens Lang
              autobot-jira-api pme bot
              Clemens Lang Clemens Lang
              Miluse Bezo Konecna Miluse Bezo Konecna
              Jan Fiala Jan Fiala
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: